Mobatek MobaXterm version 12.1 contains a structured exception handling (SEH) based buffer overflow in the username field of session files, a classic CWE‑120 flaw. Importing a crafted session file triggers the overflow, allowing the attacker to execute arbitrary code under the current user’s privileges. The attacker can then establish a reverse shell to gain further control of the affected system.

The impacted product is Mobatek MobaXterm version 12.1. No other versions or sub‑products are listed as affected in the advisory.

This vulnerability has a CVSS score of 9.3, indicating a severe risk. EPSS information is unavailable, and the CVE is not listed in the CISA KEV catalog. A remote attacker can deliver a malicious session file to an unsuspecting user; when the user imports or executes the file, the overflow is triggered, leading to remote code execution. The lack of a documented exploit reduces immediate threat, but the high severity justifies prompt attention.