Allok AVI to DVD SVCD VCD Converter version 4.0.1217 contains a structured exception handling (SEH) based buffer overflow that can be triggered through the License Name field. By supplying a crafted string—including junk data, a NSEH bypass, an overwritten SEH handler address, and shellcode—an attacker who can run the program locally can cause arbitrary code to execute. The flaw is a classic CWE‑120 stack-based buffer overflow.

Vulnerable software is Alloksoft’s Allok AVI to DVD SVCD VCD Converter, specifically the 4.0.1217 release. No other versions or products are mentioned in the advisory.

The CVSS score of 8.5 marks this flaw as high severity. Exploitation requires local access; the attacker must launch the program and enter malicious data in the License Name field before clicking the Register button. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog, indicating limited known exploitation activity so far. Nevertheless, the ability to execute arbitrary code locally presents a significant risk to system integrity if an attacker can gain user or administrative privileges within the affected environment.