This vulnerability is an out-of-bounds write caused by a buffer copy that does not check the size of the input, a classic buffer overflow flaw. It occurs in the PNG decoder modules of X‑TRACK, specifically in the inflate.C component. The flaw allows an attacker to corrupt heap memory, potentially leading to arbitrary code execution or a denial‑of‑service crash. It is catalogued as CWE‑120 and CWE‑787

The flaw affects all versions of the FASTSHIFT X‑TRACK product up to and including version 2.7. The vulnerable code resides in the lv_img_png and PNGdec src directories of the X‑TRACK application

The CVSS score for this issue is 10, indicating critical severity. The EPSS score is reported as less than 1 %, indicating a low probability of exploitation in the wild. The flaw is not currently listed in CISA’s KEV catalog. Although the exact attack vector is not detailed in the advisory, the buffer overflow likely requires the delivery of a crafted PNG or inflate input, meaning that exposure could be remote if the application accepts untrusted files over a network or local path. Given the high severity and the potential for remote code execution, the risk is considered high if the vulnerable version is deployed.