The vulnerability is a local structured exception handling (SEH) buffer overflow that is triggered by supplying an alphanumeric encoded payload in the Folder Path field. The flaw allows an attacker who can run the application to execute arbitrary code with the privileges of the application. The exploit path involves using the System Compare feature; the attacker pastes the malicious payload into the left‑hand side Folder Path field and clicks the scale icon to launch the shellcode.

Admin Express Software, version 1.2.5.485. This release is affected; no other versions are listed in the advisory. The vulnerability applies to installations of the desktop application on Windows platforms.

The CVSS score of 8.5 reflects a high‑severity local exploit requiring the attacker to have access to the affected machine. Because the vulnerability is local, it does not pose an immediate remote attack surface, and EPSS data is not available. The flaw is not currently listed in CISA's KEV catalog. Exploitation requires an attacker already present on the system or with local user credentials; the attacker can then run arbitrary code with application privileges. Given the high impact of code execution and the popularity of the application, the risk remains substantial. Administrators should treat it as a high‑severity local privilege escalation and coordinate patching as soon as possible.