A local buffer overflow in the Yasr Screen Reader allows unauthenticated local attackers to achieve arbitrary code execution on affected Linux systems.

This is a buffer overflow vulnerability occurring when the application processes an oversized argument passed to the -p command line parameter. The vulnerability is exploitable by any local user without requiring elevated privileges.

Successful exploitation of this vulnerability allows a local user to execute arbitrary code with the privileges of the user running the Yasr process. Given the CVSS score of 8.4, this represents a significant risk, as it permits privilege escalation or complete compromise of the local session. This can lead to unauthorized data access or the installation of persistent malicious tools on the affected host.

Immediate Action: Upgrade to a version of Yasr that addresses this buffer overflow vulnerability, or remove the software if it is not required for accessibility needs.

Proactive Monitoring: Monitor system logs for frequent crashes of the Yasr process or suspicious command line arguments involving the -p parameter.

Compensating Controls: Restrict access to the Yasr binary to only authorized users via file system permissions to prevent untrusted local users from executing the vulnerable application.

Public Exploit Available: Yes, a public exploit exists as documented in ExploitDB (EDB-ID: 39734).

The presence of a functional proof-of-concept exploit makes this vulnerability a credible threat to local system integrity. Administrators should prioritize updating or restricting access to the Yasr Screen Reader immediately to prevent unauthorized code execution and potential privilege escalation by local users.