A local buffer overflow vulnerability in RGui 3.5.0 allows an attacker to bypass security protections and execute arbitrary code on the host system.

This is a stack-based buffer overflow vulnerability located in the GUI preferences dialog. An attacker can supply malicious input to the Language for menus and messages field to trigger the overflow, bypass Data Execution Prevention (DEP) using a Return Oriented Programming (ROP) chain, and execute arbitrary code. This attack requires local access to the application.

Successful exploitation of this vulnerability allows an attacker with local access to the affected machine to execute code with the privileges of the user running RGui. This can lead to full system compromise, unauthorized data access, or the deployment of further malicious payloads. Given the high CVSS score of 8.4, this vulnerability represents a significant risk to the integrity and confidentiality of the host environment.

Immediate Action: Upgrade RGui to version 3.5.1 or later, where this vulnerability has been addressed.

Proactive Monitoring: Monitor system logs for unusual process execution patterns or crashes originating from the RGui application.

Compensating Controls: Restrict local access to the system to authorized users only, and ensure that software is executed with the least privilege necessary to perform required tasks.

Public Exploit Available: Yes, a public proof-of-concept exists via the ExploitDB entry 46107.

This vulnerability is critical due to the potential for arbitrary code execution and the availability of public exploit material. IT administrators should prioritize upgrading all instances of RGui 3.5.0 to a patched version immediately to eliminate this attack vector. Failure to update the software leaves the host system susceptible to local privilege escalation and potential full compromise.