A local buffer overflow vulnerability in iSelect 1.4.0-2+b1 enables local attackers to achieve arbitrary code execution by supplying malformed input.

This is a stack-based buffer overflow occurring within the handling of the -k or --key command-line argument. An attacker with local access can supply an oversized value to this parameter to overwrite the stack buffer and execute arbitrary code with the privileges of the local user running the tool.

Successful exploitation allows a local user to escalate their capabilities or execute unauthorized commands on the host system. Given the CVSS score of 8.4, this vulnerability represents a significant security risk, particularly in multi-user environments where local users may attempt to gain elevated control or access restricted system resources.

Immediate Action: Since no official patch is currently identified, administrators should restrict execution permissions for the iSelect binary to only authorized users or remove the package from systems where it is not strictly required.

Proactive Monitoring: Monitor system logs for unusual execution patterns or segmentation faults associated with the iSelect binary, which may indicate failed or successful exploitation attempts.

Compensating Controls: Implement strict file system permissions to limit access to the iSelect executable and employ kernel-level protections such as Address Space Layout Randomization (ASLR) and stack canaries to hinder exploitation.

Public Exploit Available: Yes, a published proof-of-concept exploit exists via Exploit-DB (EDB-ID: 41076).

The presence of a functional proof-of-concept exploit makes this vulnerability a credible threat to local system integrity. Organizations should prioritize restricting access to the affected binary until a vendor-supplied update or a secure alternative is available.