SysGauge Pro version 4.6.12 contains a classic stack‑based buffer overflow in its Register function. The flaw allows an attacker to supply a crafted unlock key that overwrites the structured exception handler and inject shellcode into the application’s memory. Consequently, a local user who can launch the program can execute arbitrary code with the same privileges as the application, effectively gaining control of the host.

The only affected product listed is SysGauge Pro, specifically version 4.6.12. No other versions or separate products are noted as impacted in the available CNA data.

The CVSS score of 8.6 indicates a high severity vulnerability. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that widespread exploitation has not been observed. The attack vector is local, inferred from the requirement that an attacker must run the application and supply a crafted unlock key. An attacker with local privileges can trigger the overflow, overwrite SEH, and run arbitrary code in the context of the application, posing a significant risk for privilege escalation and system compromise.