A stack-based buffer overflow in Flat Assembler 1.71.21 allows local attackers to execute arbitrary code, posing a significant risk to system integrity.

This vulnerability is a stack-based buffer overflow (CWE-787) occurring when the application fails to perform adequate boundary checks on user-supplied assembly input. An attacker can craft input exceeding 5895 bytes to overwrite the instruction pointer, facilitating a return-oriented programming (ROP) chain for shell command execution.

Successful exploitation of this vulnerability allows a local attacker to gain control over the execution flow of the application, leading to arbitrary code execution with the privileges of the user running the assembler. Given the CVSS score of 8.4, this represents a high-severity threat that could lead to unauthorized system access, data manipulation, or the installation of malicious software on the host machine.

Immediate Action: There is no official patch available for this specific version; users are advised to transition to a supported version or discontinue use of the affected software if it cannot be secured.

Proactive Monitoring: Security teams should monitor system logs for suspicious process execution patterns or abnormal crashes of the assembler, which may indicate failed exploitation attempts.

Compensating Controls: Since this is a local vulnerability, enforce strict access controls on the system to ensure that only authorized users can execute the assembler, and utilize operating system level protections like Address Space Layout Randomization (ASLR) to complicate exploitation.

Public Exploit Available: Yes, a functional exploit is available via ExploitDB (EDB-ID: 42265).

Given the availability of a published exploit and the high CVSS severity, this vulnerability presents a clear risk to local system security. Organizations currently using Flat Assembler 1.71.21 should prioritize upgrading to a current version or implementing restricted execution environments to mitigate the risk of arbitrary code execution.