The flaw allows a local attacker to crash PCHelpWareV2 1.0.0.5 by providing a BMP file that contains an oversized buffer. The malformed image causes the Create SC feature to fail, resulting in an unhandled error that terminates the application.

UVNC’s PCHelpWareV2 version 1.0.0.5 and the identical UltraVNC 1.0.0.5 are vulnerable. Users running these specific releases are at risk when the Create SC feature processes a crafted BMP image.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. It requires local access — an attacker must be able to run or influence the application on the target system. Based on the description, the exploitation path involves a user who can supply a malicious BMP file to the Create SC feature, leading to an application crash. No remote or network‑based attack vector is documented.