WinMTR version 0.91 contains a buffer overflow vulnerability in its file‑injection logic. By supplying a specially crafted input file with 238 bytes of repeated characters, an attacker can trigger an overflow that causes the application to crash. The result is a denial of service, limiting the user’s ability to perform network diagnostics, but no remote code execution or data compromise is possible with this flaw.

The vulnerability affects the WinMTR application, specifically version 0.91. No other versions or variants are listed as impacted.

The CVSS score of 8.7 indicates a high severity risk. The EPSS value is not available, and the flaw is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. The likely attack vector is through the ingestion of a malicious payload file, implying that an attacker would need to supply the file locally or arrange for a victim to open it. Once the exploit is executed, the application will terminate, potentially disrupting network monitoring services.