A critical local buffer overflow vulnerability in PassFab RAR Password Recovery 9.3.2 allows an attacker to achieve arbitrary code execution on the host system.

The application is susceptible to a buffer overflow in the registration module, specifically within the Licensed E-mail and Registration Code field. An unauthenticated local attacker can trigger this flaw by providing a crafted payload that overwrites the structured exception handler, leading to arbitrary code execution.

Successful exploitation of this vulnerability allows an attacker with local access to execute arbitrary code with the privileges of the application user. This could lead to a full system compromise, unauthorized data access, or the installation of persistent malicious software. Given the CVSS score of 8.4, this vulnerability represents a high-risk scenario for any workstation where this software is installed.

Immediate Action: There is no vendor-provided patch for this legacy software version; users should uninstall PassFab RAR Password Recovery 9.3.2 immediately. If the software is required, restrict access to the host machine to authorized personnel only.

Proactive Monitoring: Monitor system logs for unexpected application crashes or execution of unauthorized processes initiated by the PassFab executable.

Compensating Controls: Ensure that Endpoint Detection and Response (EDR) solutions are configured to monitor for process injection or suspicious memory patterns associated with the application.

Public Exploit Available: Yes, a functional local exploit exists as documented on Exploit-DB (EDB-ID 46008).

Due to the availability of a functional exploit and the severity of the potential impact, this vulnerability poses a significant risk to local system integrity. Administrators should prioritize the removal of the vulnerable software from all endpoints. If removal is not feasible, restrict application execution to prevent non-privileged users from interacting with the vulnerable registration interface.