Improper control of code generation enables an attacker to inject and execute arbitrary code on systems that use the affected Mesalvo Meona components. The vulnerability, classified as CWE‑94, allows malicious input to be interpreted as code, leading to full compromise of confidentiality, integrity, and availability. The impact is a critical failure that can affect any user interacting with the components, potentially allowing an attacker to take over the affected system.

The flaw affects assets from Mesalvo: the Meona Client Launcher Component for all releases prior to June 19, 2020 15:11:49, and the Meona Server Component for all releases prior to version 5.323020 released April 2025. Users running these older versions are exposed.

With a CVSS score of 9.0 the vulnerability is marked as critical, and although the EPSS score is not provided, the lack of mitigation guidance suggests a non‑negligible exploitation likelihood. The flaw is not listed in the CISA KEV catalog, indicating no known public exploits, but the remote code execution potential and high severity mean a suspicious risk. Based on the description, the attack vector most likely involves injecting code through user‑supplied data that the Meona components evaluate or execute.