The vulnerability is a use‑after‑free condition in XnSoft NConvert 7.230 that is triggered when the program processes a specially crafted TIFF file. The flaw occurs after the program frees memory that it later dereferences, which can lead to memory corruption and potentially arbitrary code execution if an attacker can supply the crafted file. This is a classic example of CWE‑416 and represents a medium severity risk to confidentiality, integrity, and availability of affected systems.

The affected software is XnSoft's NConvert application, version 7.230. This version is distributed and documented on the official XnView website. No other versions or products are listed as affected in the provided data.

The CVSS score for this flaw is 6.2, indicating medium risk, while the EPSS score is below 1%, suggesting a low probability of widespread exploitation. The flaw is not listed in CISA’s KEV catalog. Because the trigger requires a crafted .tiff file, the likely attack vector is local or remote file processing, such as via an application that accepts user‑supplied TIFF files. No additional prerequisites are recorded, so an attacker needs access to a system running NConvert 7.230 to load a malicious file.