A buffer overflow exists in the Structured Exception Handling (SEH) chain of the Echo Port tab of RealTerm Serial Terminal. The flaw allows a local attacker to insert a crafted payload into the Port field and trigger execution by clicking the Change button. By using a POP POP RET gadget chain and shellcode the attacker can gain arbitrary code execution within the context of the running instance. This vulnerability is a classic SEH buffer overflow (CWE-787) that impacts confidentiality, integrity, and the availability of the application if executed.

The affected product is RealTerm Serial Terminal, released by Realterm. Version 2.0.0.70 is vulnerable and no other versions or variants are listed as affected. Users running this specific build on any supported platform face the risk.

The CVSS score of 8.5 marks the issue as high severity, and the exploitation requires local privilege because the attacker must have access to the host and be able to run the application. With no EPSS data and absence from the KEV catalog, no widespread exploitation is documented. If exploited, the attacker would execute arbitrary code with the privileges of the user running the application, potentially compromising the entire system. The attack path involves locally injecting a malicious string into the Port field and activating the Change action to trigger the SEH overflow.