A local buffer overflow exists in structured exception handling within 10-Strike LANState 8.8. By crafting a malicious LSM file, a local attacker can overflow a buffer in the ObjCaption parameter, overwrite the SEH chain, and execute arbitrary shellcode when the file is opened. The vulnerability permits attackers to run code with the privileges of the user launching the file, potentially compromising system integrity and confidentiality.

The affected product is Strike LANState, version 8.8, distributed by 10-Strike. No other versions were specifically mentioned as affected in the available data.

The vulnerability carries a CVSS score of 8.6, indicating high severity. EPSS data is not available, but the flaw is in a local context and would not be exploitable remotely. The entry is not listed in CISA’s KEV catalog. Attackers require local access to the target system, the ability to create and open an LSM map file, and the application must be running to trigger the overflow. Successful exploitation results in code execution, elevating threat to full system compromise.