The vulnerability is a local buffer overflow in structured exception handling that allows an attacker to craft a malicious WAV file to overwrite the SEH chain and execute arbitrary code. The flaw occurs when processing excessively large data blocks within WAV files, permitting attackers to control execution flow. Successful exploitation would give the attacker full code execution on the affected Windows system, potentially compromising confidentiality, integrity, and availability of the system.

Boxoft WAV to WMA Converter version 1.0, distributed by Boxoft, runs on Windows systems. No other version details are specified.

The flaw carries a CVSS score of 8.6, indicating high severity. However, the EPSS score is less than 1% and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, so the likelihood of exploitation in the wild is low. The attack requires local access to the target machine, the creation of a crafted WAV file, and execution of the converter. Once an attacker gains local access or convinces a user to run the malicious file, they can achieve arbitrary code execution by overwriting the SEH chain with return-oriented programming gadgets.