Arm Whois 3.11 contains a stack‑based buffer overflow that allows a remote attacker to send an oversized IP address or domain string exceeding 658 bytes. The overflow overwrites the structured exception handler, enabling arbitrary code execution with the privileges of the running process. The vulnerability can be used to run shellcode, granting the attacker full control over the affected system.

The affected vendor is Armcode, product Arm Whois. The vulnerability applies to version 3.11. No other versions are listed as affected.

The CVSS score of 9.3 signals critical severity. While EPSS is not available, the lack of KEV listing does not diminish the risk because the vulnerability permits remote exploit through normal network traffic. Attackers can craft malicious input during normal usage of Arm Whois to trigger the overflow, resulting in attacker‑controlled code execution. The exploit requires only network access to the Arm Whois service and no user interaction besides sending the payload.