The conversion utility contains a stack‑based buffer overflow in the License Name field that allows a local user to inject an oversized string. By including shellcode within the payload and overwriting the SEH chain, the attacker can execute arbitrary code with the privileges of the running application. This flaw can lead to complete control over the host when the program is run with elevated privileges, compromising confidentiality, integrity, and availability.

Alloksoft WMV to AVI MPEG DVD WMV Converter version 4.6.1217. The vulnerability is not present in earlier versions and no other releases have been identified as affected.

The CVSS score of 8.6 denotes a high‑severity local exploitation risk; the EPSS score is not available, so the likelihood is unquantified, but the lack of a KEV listing suggests no widespread exploitation in the field yet. Attackers must have local access to the system and the ability to run the program, making this threat relevant to users who install and run the converter. Exploitation requires an oversized License Name input that successfully performs the SEH overwrite, thereby allowing arbitrary code execution.