A critical stack-based buffer overflow in Mapscrn 2.0.3 allows local attackers to achieve arbitrary code execution or crash the application.

This is a stack-based buffer overflow vulnerability (CWE-787) triggered by providing an oversized input buffer to the application. The vulnerability is exploitable by local, unauthenticated users.

The ability for a local attacker to execute arbitrary code poses a significant risk to system integrity and confidentiality. Successful exploitation could allow an attacker to escalate privileges or compromise the host system, while failed attempts result in a denial of service, impacting system availability. With a CVSS score of 8.4, this vulnerability represents a high-severity risk that requires immediate attention in environments where the software is deployed.

Immediate Action: As there is no official patch currently available, users should restrict access to the mapscrn binary by limiting execution permissions to authorized users only. If the functionality is not required, remove or disable the mapscrn utility entirely.

Proactive Monitoring: Monitor system logs for unusual process crashes or segmentation faults that may indicate failed exploitation attempts of this buffer overflow.

Compensating Controls: Implement system-level security controls such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) to make exploitation of memory corruption vulnerabilities more difficult.

Public Exploit Available: Yes, a proof-of-concept exists as detailed in the Exploit-DB entry 42144.

Given the high CVSS score and the public availability of exploit code, this vulnerability presents a clear and present danger to local system security. Administrators must prioritize restricting access to the vulnerable binary and consider removing the component if it is not essential for daily operations. Future updates from the vendor should be monitored and applied immediately upon release.