Technical impact
Iperius Backup version 5.8.1 contains a local buffer overflow within its structured exception handling that could be exploited by maliciously crafted file paths. An attacker who can run commands on the host and create a backup job with a crafted payload in the external file location field can trigger the overflow and gain execution with the same privileges as the backup application. This flaw allows an attacker to run arbitrary code with application-level permissions, posing a serious confidentiality and integrity risk on compromised systems.
Affected Systems
The vulnerability is limited to Iperius Backup software. Systems running version 5.8.1 of the backup application are affected unless patched. No other products or versions are known to be impacted.
Risk and Exploitability
The CVSS score of 8.6 indicates a high severity, and while no EPSS score is available, the lack of a KEV listing suggests no widespread exploitation to date. The attack requires local access to the machine and the ability to submit a backup job, so it is a local attacker scenario. If an attacker can create or influence backup configurations, they can trigger the overflow and execute code with application privileges.
