SpotIE Internet Explorer Password Recovery 2.9.5 includes a buffer overflow vulnerability (CWE-787) in the registration key input field. An attacker with local access can paste a 256‑character payload into the Key field during registration to trigger the overflow and crash the application, resulting in a denial‑of‑service condition. The crash limits the impact to application availability; it does not provide direct access to sensitive data or further code execution.

Affected product: Nsauditor:SpotIE Internet Explorer Password Recovery version 2.9.5. No additional version detail is supplied by the CNA. The flaw is local, requiring the attacker to run the application on the target machine or be able to manipulate the registration form in that environment.

The CVSS score of 6.9 indicates a medium severity vulnerability. EPSS is below 1%, reflecting a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers need local access; thus the risk is confined to availability. The medium CVSS score together with the low EPSS suggest that the overall risk to systems is moderate but primarily limited to service disruption.