River Past Video Cleaner version 7.6.3 contains a structured exception handler buffer overflow that allows a local user to execute arbitrary code by providing a specially crafted string in the Lame_enc.dll field. By inserting 280 bytes of padding, overwriting the next SEH record, and injecting shellcode, the application will transfer control to the attacker’s payload, resulting in a full code execution—an uncontrolled buffer overflow (CWE‑787).

The only affected product is River Past Video Cleaner version 7.6.3; no other vendors or versions are listed by the CNA.

The CVSS score of 8.6 indicates high severity for local attackers who can supply input to the application. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV database, suggesting that widespread exploitation is currently undocumented. The attack requires a local user to supply a malicious string to the Lame_enc.dll field; there is no known network-facing entry point, so the greatest risk lies with individuals who have direct local access to the machine.