R 3.4.4 for Windows XP SP3 contains a local buffer overflow in the GUI Preferences 'Language' field. An attacker who can input data into this field can craft a 292‑byte payload containing a JMP ESP instruction that causes the program to execute arbitrary code, such as launching calc.exe. The effect is a full compromise of the R process and the underlying OS on the affected machine.

The affected product is the R Programming Language version 3.4.4 running on Windows XP Service Pack 3. Users running this specific version of R on that operating system are at risk of exploitation.

The vulnerability has a CVSS score of 8.6, indicating high severity. No EPSS score is available and it is not listed in the CISA KEV catalog. The attack vector is local; an attacker must have local access to paste the malicious string into the Preferences window. Once exploited, the attacker can execute any code with the privileges of the R process, potentially affecting confidentiality, integrity, and availability of the affected system.