A buffer overflow vulnerability in the TiEmu 3.03 calculator emulator allows unauthenticated local attackers to execute arbitrary code or cause a denial of service.

The application fails to properly validate the length of the ROM parameter provided via the command-line interface, resulting in a stack-based buffer overflow. An attacker with local access can trigger this by supplying an oversized string, which overflows the buffer and allows for the redirection of the instruction pointer to malicious code.

The ability to execute arbitrary code on a host system poses a significant security risk, potentially leading to a full compromise of the local environment. While the vulnerability requires local access, the high CVSS score of 8.4 reflects the severity of the potential impact, including complete loss of confidentiality, integrity, and availability for the affected process.

Immediate Action: Users should discontinue the use of TiEmu 3.03 and migrate to a supported, patched version or an alternative emulation solution if a fix is not available.

Proactive Monitoring: Security teams should monitor system logs for unusual command-line executions or unexpected application crashes associated with the TiEmu binary.

Compensating Controls: Ensure that the host operating system is configured with modern exploit mitigation features, such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP), which may hinder the reliability of such buffer overflow attacks.

Public Exploit Available: Yes, a public exploit exists as documented in the Exploit-DB entry 39692.

Given the availability of a public exploit and the potential for arbitrary code execution, this vulnerability represents a severe risk to any system where the affected software is installed. Administrators should prioritize the removal or replacement of the vulnerable emulator to prevent potential unauthorized access or system instability.