This flaw is a stack buffer overrun that can be triggered by processing a specially crafted TIFF file. The overflow can overwrite control data on the stack, potentially allowing the attacker to execute arbitrary code in the context of the application. While the description does not state the full extent of the damage, buffer overflows of this type typically enable reliable code execution once the overwrite is successful.

The vulnerability affects the XnView NConvert utility, specifically version 7.230. It is available for the platforms supported by XnView, including Windows and macOS.

The CVSS score of 6.2 indicates a moderate severity, and the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at present. The attack requires a victim to run NConvert on a file crafted by an attacker, implying a local or user‑initiated exploitation scenario rather than an automated remote attack. The vulnerability is not listed in the CISA KEV catalog, further indicating that there are no known widespread exploit attempts documented.