The updated vulnerability advisory confirms that improper control of code generation in the Mesalvo Meona Client Launcher Component and Meona Server Component allows an attacker to inject and execute arbitrary code, realizing remote code execution on systems that utilize the affected components. This flaw, categorized as CWE‑94, permits malicious input to be interpreted as code, enabling full compromise of confidentiality, integrity, and availability.

The flaw affects assets from Mesalvo: the Meona Client Launcher Component for all releases prior to June 19, 2020 15:11:49, and the Meona Server Component for all releases prior to version 5.323020 released April 2025. Users running these older versions are exposed.

With a CVSS score of 7.9 the vulnerability is considered high severity; although the EPSS score is less than 1%, the remote code execution potential and high severity imply a significant risk. The flaw is not listed in the CISA KEV catalog, indicating no known public exploits, but the attack vector most likely involves injecting code through user‑supplied data that the Meona components evaluate or execute.