The vulnerability is a stack-based buffer overflow in Disk Pulse Enterprise 9.0.34 that is triggered by an excessively long username included in an HTTP POST to the /login endpoint. The overflow occurs in the libspp.dll component, allowing an attacker to overwrite control data and execute arbitrary code with SYSTEM privileges, creating a full compromise of the affected system.

Falconstor Software’s Disk Pulse Enterprise version 9.0.34 is affected by this flaw; no other products or versions are explicitly listed.

The CVSS score of 8.6 indicates high severity, while an EPSS of <1% points to a relatively low probability of exploitation in the wild. The attack vector is remote: the attacker only needs to send the crafted POST request over the network, with no local user privileges or pre‑existing access required. The vulnerability is not included in the CISA KEV catalog, but remote code execution at the SYSTEM level presents a severe risk to impacted installations.