A stack-based buffer overflow in xWPE version 1.5.30a-2.1 and prior allows local users to achieve arbitrary code execution or cause system instability.

The application suffers from a stack-based buffer overflow (CWE-787) due to insufficient boundary checking on user-supplied command-line arguments. An attacker can supply a malicious string exceeding 262 bytes to overwrite the instruction pointer, allowing for arbitrary code execution in the context of the application.

Successful exploitation allows a local attacker to gain the same execution privileges as the user running the xWPE editor. Given the CVSS score of 8.4, this represents a high-severity risk, as it can lead to full system compromise if the editor is executed by a privileged user or within a sensitive environment.

Immediate Action: Update xWPE to a version beyond 1.5.30a-2.1 if a patch is available from the vendor, or discontinue use of the software if updates are no longer provided.

Proactive Monitoring: Monitor system logs for unusual process crashes or execution attempts involving unexpected command-line arguments directed at the xWPE binary.

Compensating Controls: Restrict execution permissions for the xWPE binary to authorized users only, and ensure that the application is not run with elevated privileges unless strictly necessary.

Public Exploit Available: Yes, a local exploit is available via Exploit-DB (EDB-ID: 39285).

Due to the availability of a functional local exploit and the severity of potential code execution, organizations should prioritize the removal or patching of affected xWPE instances. If the software cannot be updated, it should be removed from all systems to eliminate the local attack vector entirely.