River Past CamDo 3.7.6 contains a structured exception handler buffer overflow that can be triggered by a local attacker who supplies a malicious string in the Lame_enc.dll name field. By injecting a 280‑byte payload containing an NSEH jump and an SEH handler that points to a pop‑pop‑ret gadget, the attacker can gain arbitrary code execution and create a bind shell listening on port 3110.

The vulnerability affects River Past CamDo version 3.7.6, distributed for Windows. No other vendors or products are listed. Users running that version should review their installation and ensure no untrusted access to the Lame_enc.dll file.

The CVSS score is 8.6, indicating high severity. No EPSS data is available and the flaw is not present in the CISA KEV catalog. The attack requires local access and the ability to input a crafted filename, so it is a local privilege escalation flaw that could allow a malicious user on the machine to execute code, compromise data, or establish a remote shell. Given the high CVSS, the risk to an affected system is significant if the local attacker is a potential threat actor.