AIDA64 Business 5.99.4900 is vulnerable to a structured exception handling buffer overflow that can be triggered by injecting malicious shellcode through the SMTP display name feature. The overflow overwrites the SEH pointers and allows an attacker with local access to execute arbitrary code at application privileges. This exploitation path directly compromises confidentiality and integrity of the affected system by enabling arbitrary code execution within the context of AIDA64.

The vulnerability impacts the Aida64 AIDA64 Business product, specifically version 5.99.4900 on all supported operating systems where the SMTP preferences or report wizard feature is enabled. No other versions or products are listed as affected.

The CVSS score of 8.6 indicates a high severity for local attackers, while the EPSS score of less than 1% suggests a low probability of widespread exploitation. The vulnerability is not currently listed in CISA’s KEV catalog. Exploitation requires local access to the machine and the ability to modify application preferences or initiate a report wizard, therefore the attack vector is local. Given these conditions, users must consider the potential for full system compromise through this local code execution route.