A buffer overflow vulnerability in Explorer32++ version 1.3.5.531 permits attackers to execute arbitrary code through malicious file name inputs.

The software fails to properly sanitize file name arguments, leading to a buffer overflow in the Structured Exception Handler (SEH) chain. By providing a string exceeding 396 characters, an attacker can overwrite memory and divert execution flow to malicious code.

With a critical CVSS score of 9.8, this vulnerability allows for full system compromise via arbitrary code execution. Successful exploitation could grant an attacker complete control over the host machine, leading to data exfiltration, ransomware deployment, or lateral movement within the corporate network.

Immediate Action: Cease use of Explorer32++ version 1.3.5.531 and apply any available security updates or patches from the vendor.

Proactive Monitoring: Monitor system processes for unusual execution behavior or child processes spawned by the file explorer application.

Compensating Controls: Use Endpoint Detection and Response (EDR) solutions to flag and block memory corruption patterns or suspicious process execution.

Public Exploit Available: Unknown

Given the high CVSS score of 9.8 and the risk of Remote Code Execution (RCE), this vulnerability must be mitigated immediately. If no patch is available, consider replacing the application with a secure alternative until the vendor provides a remediation for the SEH overflow.