The vulnerability is a buffer overflow in the chat message parsing logic of Easy Chat Server 3.1. A remote attacker can send a specially crafted message that overflows a stack buffer, exposing sensitive information and allowing arbitrary code execution as the server process. The flaw falls under CWE‑120 and compromises both confidentiality and integrity, giving the attacker complete control over the server and potentially the underlying host.

Products affected are instances of Easy Chat Server version 3.1. No earlier or later versions are publicly identified as vulnerable. Customers running this exact version are exposed; no vendor labels are available in the advisory.

The attack vector is remote over the network using the standard message endpoint. EPSS data is not available, but the absence of a patch and the remote nature of the exploit mean that an attacker with network access could potentially trigger the overflow at any time. The vulnerability is not listed in CISA’s KEV catalog, and its CVSS score of 7.3 reflects high severity, underscoring a significant risk for any deployed instance.