Tomabo MP4 Converter version 3.25.22 contains a buffer overflow flaw that can be exploited by a local attacker. By entering an excessively long string in the Name field when creating a preset under Video/Audio Formats options, the program overflows a buffer and crashes. The result is a denial of service of the application, which can disrupt legitimate usage. The weakness is a classic out‑of‑bounds write, classified as CWE‑787.

The affected product is Tomabo MP4 Converter, specifically version 3.25.22. No other versions or variants are listed as vulnerable. The CPE identifier confirms that the issue targets this single release.

The CVSS score of 6.8 indicates moderate to high severity. Exploitability evidence is limited to local attacks, as the overflow occurs within the application context; no remote trigger is known. An EPSS value is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting it has not been widely exploited in the wild. Nonetheless, the local nature of the flaw means that users who grant local access to the victim machine (e.g., shared workstations) could cause the application to crash, potentially interrupting workflows or triggering rebounded processes. The available exploit in exploit‑db demonstrates feasibility, but it requires manual interaction.