A local buffer overflow exists in FlexHEX version 2.71 within the Stream Name dialog. By copying crafted text containing shellcode and SEH chain pointers into the field, a local attacker can trigger the structured exception handler and execute arbitrary commands such as launching calc.exe.

The vulnerability affects the FlexHEX application, version 2.71, from the vendor Flexhex. No other versions or vendors are listed as affected.

The CVSS base score of 8.6 indicates high severity. The attack requires local access and user interaction with the application, and a malicious file can be easily constructed to trigger the overflow. While no EPSS data or KEV listing is available, the high score and straightforward local execution path imply a significant risk to machines running the vulnerable software.