EChat Server 3.1 contains a classic buffer overflow flaw in the chat.ghp endpoint when the username parameter is oversized. Attackers can exploit this by sending a crafted GET request that injects shellcode and ROP chains, allowing arbitrary code to run inside the application process. The weakness is a classic out-of-bounds write, identified as CWE‑787, and, if successfully exploited, can compromise confidentiality, integrity, and availability of the affected system.

The vulnerability affects the EChat Server product from Echatserver, specifically version 3.1. No other product versions are mentioned in the advisory, so the impact is limited to this exact build.

The CVSS score is 9.3, classifying the flaw as critical. The EPSS score is below 1 %, indicating a low probability of current exploitation, and it is not listed in the CISA KEV catalog. The likely attack vector is remote HTTP access to the chat.ghp endpoint, meaning an attacker only needs network connectivity and knowledge of the URL to mount a successful exploit.