A stack‑based buffer overflow has been discovered in the Preferences dialog of RGui version 3.5.0. The flaw allows a local attacker who can manipulate the "Language for menus and messages" field to overwrite the stack, use a return‑oriented programming chain to allocate executable memory, and ultimately execute arbitrary code. The weakness is a classic buffer overflow that defeats DEP protections via structured exception handling exploitation.

The vulnerability affects only the Windows 32‑bit or 64‑bit executable of RGui 3.5.0 distributed by the R‑Project. Earlier or later releases of RGui are not impacted.

The CVSS base score of 8.6 signals a high‑severity issue. No EPSS value is reported, and the vulnerability is not catalogued in the CISA KEV list. Because the exploit requires local access to the RGui application, the attack vector is local; however, once successfully exploited the adversary can take arbitrary code execution on the affected system, posing a severe risk to confidentiality, integrity, and availability. The lack of a KEV listing and unavailable EPSS score do not undercut the immediate threat posed by the high CVSS score and the potential for local code compromise.