A stack-based buffer overflow (CWE‑121) in the WOSDefaultHttpModule.dll component is triggered when the server processes a URL path that exceeds normal length requirements and begins with /woshome. This overflow can corrupt the call stack and potentially allow an attacker to execute arbitrary machine code on the host, posing a severe risk to system integrity and availability.

Gladinet Triofox systems are affected. No specific version information is publicly available, so all deployed instances of Triofox should be considered at risk until a vendor fix is applied.

The CVSS score of 9.8 signals a critical vulnerability. There is no EPSS score available and the issue is not listed in the CISA KEV catalog, but the high magnitude of the CVSS score alone indicates a significant threat surface. The most probable attack vector is remote, via a specially crafted HTTP request containing an excessively long URL path starting with /woshome, as inferred from the description.