SIPP 3.3 contains a stack based buffer overflow that can be triggered by providing a malformed configuration file. By crafting configuration entries with values that exceed the expected length, the overflow overwrites the stack return address, allowing an attacker to redirect execution flow with return oriented programming gadgets. Because the vulnerability is local and does not require authentication, any user who can write or replace the configuration file used by SIPP can obtain arbitrary code execution on the host.

The affected product is SIPP version 3.3, as distributed by the Sipp Project. No other versions are specifically noted in the advisory, so only the 3.3 release is confirmed to contain the flaw.

The CVSS scoring of 8.6 indicates a high severity level, though the EPSS score of less than 1% suggests that exploitation is currently rare or not widely observed. The vulnerability is listed as local, unauthenticated code execution, and is not included in the CISA KEV catalog, implying no known public exploits at the time of the advisory. Because the attack vector relies on local file system access, an attacker would need permission to create or modify the configuration file used by SIPP. The absence of a remote or privilege escalation vector limits the immediate exposure to environments where SIPP is exposed to local users.