VideoCharge Studio 2.12.3.685 suffers a stack-based buffer overflow triggered by a specially crafted .VSC configuration file. The vulnerability is caused by improper validation of user supplied data within the XML 'Name' attribute, which overwrites the Structured Exception Handler and gives an attacker the ability to write arbitrary code on the stack. The weakness corresponds to CWE-121, CWE-20, and CWE-94 and enables execution of attacker supplied payload with the privileges of the user who opens the file.

The affected product is VideoCharge Software:Studio, version 2.12.3.685. No other products or versions were indicated as vulnerable.

The CVSS score is 8.4 and the EPSS score of 9% indicates a moderate probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local file execution scenario where an adversary convinces an end‑user to open a malicious .VSC file, resulting in arbitrary code execution under the user’s context.