Free MP3 CD Ripper version 2.8 contains a stack-based buffer overflow in the processing of WMA files. A local attacker can craft a malicious WMA file that, when loaded through the Convert function, overflows the stack and manipulates Structured Exception Handling. This overflow allows the attacker to bypass DEP protection and execute arbitrary code via return‑oriented programming and shellcode injection.

The vulnerability affects the Free MP3 CD Ripper software distributed by Commentcamarche, specifically version 2.8. No other vendors or product versions are listed as affected.

The CVSS score of 8.6 indicates a high severity vulnerability. Because there is no reported EPSS score and the vulnerability is not listed in the CISA KEV catalog, the likelihood of exploitation is uncertain, but the local attack surface and ability to achieve code execution suggest a considerable risk if the software is used in environments where untrusted WMA files may be processed. Attackers would need local access to the system running the application.