A buffer overflow occurs in the SEH processing of the license code field in TuneClone version 2.20. When an attacker supplies a malicious license string that contains a full stack buffer, an NSEH jump instruction and an SEH handler address pointing to a return‑oriented‑programming gadget, the overflow corrupts the exception chain and allows execution of arbitrary code. The vulnerability is limited to the TuneClone process, but the code runs with the same privileges as the user who supplies the license, providing local code execution.

The flaw affects the TuneClone application. Only the 2.20 build distributed by TuneClone is known to contain the legacy SEH handler code that triggers the overflow. No other versions or additional vendors were identified in the CNA data.

The CVSS score of 8.6 indicates a high severity risk. No EPSS score is available and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers must have local access to the target machine to supply the crafted license string, meaning the exploitation path requires a user session or some form of remote foothold that enables local input. The existence of publicly available exploits and a known ROP gadget sequence suggests that skilled adversaries can manually construct a payload. Because execution occurs with the caller’s privileges, the vulnerability can be used for local privilege escalation or to run malware within the TuneClone process.