Lavavo CD Ripper 4.20 has a structured exception handling buffer overflow that can be triggered by supplying a crafted string in the License Activation Name field. When the application processes this input, a malicious payload can overwrite the SEH chain, redirect execution flow, and spawn a bind shell on port 3110. This results in local code execution, allowing an attacker to run arbitrary code with the privileges of the logged‑in user. The flaw is a classic heap-based buffer overflow (CWE‑787).

The vulnerability affects Lavavo CD Ripper version 4.20 from Lavavosoftware. No other product versions are listed, so installations of 4.20 are considered vulnerable. The application is a Windows-based CD copying utility typically used in desktop environments.

The CVSS score of 8.6 categorizes it as high severity. The exploit requires local access to the affected machine; the EPSS score is not available, so the likelihood of exploitation is uncertain, but the lack of a CISA KEV listing suggests no widespread exploitation yet. Attackers could introduce the malicious input via a forged license name field or a special license file, making the vulnerability exploitable in environments where users can manipulate that input. No public exploitation report beyond the available proof‑of‑concept exists.