Excel Password Recovery Professional 8.2.0.0 contains a local buffer overflow that occurs when a user enters an excessively long string into the 'E-Mail and Registrations Code' field. A crafted payload of 5000 bytes can be used to crash the application when the Register button is pressed, resulting in a denial of service. The vulnerability exploits a classic write-to-buffer overflow weakness (CWE-787).

Only the 8.2.0.0 edition of Excel Password Recovery Professional, distributed by Recoverlostpassword (PassFab), is listed as affected by this vulnerability. No other product versions, vendors, or operating systems are explicitly mentioned in the advisory.

The CVSS score of 6.8 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not present in CISA’s KEV catalog. Because the exploit requires that an attacker enters the malicious input into the application’s registration field, it is only a local denial of service that affects the application’s availability; it does not compromise confidentiality, integrity, or privilege escalation.