A stack-based buffer overflow exists in Easy File Sharing HTTP Server version 7.2. The flaw is triggered by a long Email parameter in a POST request to the /sendemail.ghp endpoint. The lack of length validation corrupts the stack, allowing an unauthenticated attacker to run arbitrary code with the privileges of the server process. The vulnerability is a classic buffer overflow, identified as CWE-119.

EFS Software Inc. Easy File Sharing HTTP Server version 7.2 is affected. No other versions or products are currently known to be vulnerable.

The CVSS score of 9.3 highlights a high severity remote exploitation risk, while the EPSS of 53% indicates it is likely to be actively exploited. The vulnerability is not listed in the CISA KEV catalog, but the attack vector is a remote unauthenticated POST to /sendemail.ghp, which can be leveraged to achieve full remote code execution on the underlying server.