The vulnerability is a local buffer overflow in River Past Ringtone Converter 2.7.6.1601. An attacker can exploit this by pasting an excessively long string—300 bytes—into the Email textbox or Activation code textarea within the Activate dialog that is accessed via the Help menu. The overflow triggers a crash of the application, resulting in a denial of service.

Affected systems are installations of River Past Ringtone Converter produced by Riverpast, specifically version 2.7.6.1601. No other versions or editions are explicitly mentioned. Users running this version on any supported operating system are vulnerable.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score is not provided, so the likelihood of exploitation is uncertain. The vulnerability does not appear in the CISA KEV catalog. Exploitation requires local access; the attacker must have the ability to run the application and interact with the Activate dialog. Because the vulnerability causes only a crash and not arbitrary code execution or credential compromise, the impact is limited to service availability, but it can disrupt workflow and potentially be leveraged in a larger attack chain if the application runs with elevated privileges.