Allok Video to DVD Burner 2.6.1217 includes a stack-based buffer overflow in the License Name field used during registration. A malicious input consisting of 780 bytes of garbage followed by crafted SEH chain pointers and shellcode can overwrite the structured exception handler, allowing code to execute with the privileges of the running user. This vulnerability gives local attackers the ability to run arbitrary code, potentially leading to full system compromise if the user has administrative rights.

The affected product is Alloksoft’s Allok Video to DVD Burner version 2.6.1217. The buffer overflow exists only in this version’s registration interface. The application is a Windows desktop tool that requires user interaction to register the software.

The CVSS score of 8.6 classifies this flaw as a high severity issue, and the EPSS score is currently unavailable. It is not listed in the CISA KEV catalog. The vulnerability is exploitable by a local user who can input data into the License Name field, so the attack vector is inferred to be local. Because the exploit overwrites the SEH, it can lead to arbitrary code execution and potentially privilege escalation if the attacker can gain administrative privileges to the machine.