AIDA64 Extreme 5.99.4900 contains a structured exception handling buffer overflow that allows a local attacker to supply crafted input through the email preferences and report wizard interfaces. The vulnerability is a classic out‑of‑bounds write (CWE‑787) which, when triggered by placing data in the Display name field or Load from file parameter, overwrites a SEH record and transfers execution to injected shellcode. This provides the attacker with the application’s privileges, potentially compromising the confidentiality, integrity, and availability of the affected system.

The flaw affects Aida64’s Extreme edition, specifically version 5.99.4900. Users running this build are vulnerable when using the email preferences or report wizard features; no other versions or product variants are listed, so newer releases or unrelated products are presumed unaffected.

The CVSS score of 8.6 marks the issue as high severity while the EPSS score of less than 1 % indicates a low probability of exploitation in the wild. The vulnerability is not in CISA’s KEV catalog. The attack vector requires local access and the ability to interact with the application’s privileged interfaces. If a local attacker can provide malicious input, the SEH overwrite can be triggered, leading to arbitrary code execution within the process context.