Prime95 29.4b8 holds a local buffer overflow vulnerability that enables attackers to execute arbitrary code by taking advantage of the structured exception handling (SEH) mechanism. The overflow can be triggered by supplying a malicious proxy hostname string in the PrimeNet connection settings. Successful exploitation permits the attacker to run any system command with the privileges of the user running Prime95, effectively compromising the host.

The vulnerability affects the Prime95 calculation engine distributed by Mersenne, specifically the 29.4b8 release and subsequent releases 30.7 and 30.7 build9 as listed in the CPE. Users operating these versions on any supported operating system harbor the flaw until the vendor issues a patch.

The CVSS score of 8.6 indicates a high severity for local arbitrary code execution. Because the vulnerability is local, an attacker must have the ability to run Prime95 or influence its configuration; no remote exploitation vector is documented. EPSS data is unavailable, but the flaw is listed as not in the KEV catalog, suggesting limited known exploitation. Nonetheless, the high CVSS and the ability to run arbitrary code with user privileges warrants immediate attention.