MegaPing contains a local buffer overflow that allows an attacker to crash the application by sending an oversized payload to the Destination Address List field used by the Finger function. The overflow occurs when the application does not properly validate the length of the input; when the Start button is pressed, the malicious buffer corrupts the stack and terminates the program, causing a denial of service. The weakness is a classic C/C++ buffer overrun, corresponding to CWE‑787.

The vulnerability affects Magnetosoft MegaPing version 1.0. No other products or versions were listed as impacted. The exploit could target any installation of the 1.0 build that accepts Finger requests.

The CVSS score of 6.9 indicates a moderate severity, focused on integrity of availability. The EPSS score of less than 1% suggests low likelihood of exploitation in the wild, and the issue is not listed in CISA’s KEV catalog. Because the exploit requires local access to craft the oversized payload, the attack vector is inferred to be local. An attacker would need to run a process on the same machine that invokes MegaPing’s Finger function with a malicious input. The crash would terminate the process and potentially impact service availability, but does not provide remote code execution or data exfiltration.