Out‑of‑bounds write in the mongoose module of wxhelper leads to a heap‑based buffer overflow. The overflow can corrupt memory, potentially resulting in application crashes or data integrity failures. In the worst case, the corrupted memory could be leveraged to execute arbitrary code, though the CVE description does not explicitly confirm this outcome.

The wxhelper application from the ttttupup project is affected. All releases up to and including version 3.9.10.19‑v1 contain the vulnerability in the source file mongoose.C that is used by wxhelper modules.

The CVSS score is 10, indicating critical severity. The EPSS score is below 1%, implying a very low exploitation probability as of this analysis, and the vulnerability is not listed in the CISA KEV catalog, so no public exploits are known. Based on the description, it is inferred that an attacker could supply malformed input to the mongoose module—potentially via a network service or a local file—to trigger the overflow. The attack vector could be remote if the module accepts external input, or local if the service runs with sufficient privileges on the host. The high severity and the possibility of arbitrary code execution make the risk significant once the flaw is exploited.