Atomic Alarm Clock version 6.3 suffers from a stack buffer overflow in the Time Zones Clock configuration. A local attacker can input a malicious string into the display name textbox that overwrites the Structured Exception Handling (SEH) pointer and carries encoded shellcode. Because SafeSEH protection is bypassed, the overflow allows the attacker to hijack execution flow and run arbitrary code with the application’s credentials. This vulnerability enables local arbitrary code execution, potentially leading to privilege escalation if the application runs with elevated privileges.

The flaw affects only Atomic Alarm Clock 6.3 from Drive-software; no other vendors or product versions are listed as impacted.

The CVSS base score of 8.6 indicates high severity, and the vulnerability remains unchecked by the CISA Known Exploited Vulnerabilities catalog. EPSS is not available, so the overall exploitation probability cannot be quantified, but the absence of documented widespread exploitation suggests it is not yet a known active threat. The attack requires local interaction with the application’s Time Zones Clock configuration, meaning any user who can launch Atom Alarm Clock on the affected system can potentially trigger the overflow. The use of SEH overwrite and encoded shellcode demonstrates that the attack vector is local via the application interface, with the primary risk being local arbitrary code execution.