A stack-based buffer overflow in AVS Audio Converter 9.1.2.600 allows local attackers to achieve arbitrary code execution by injecting a malicious payload into the application interface.

This is a stack-based buffer overflow (CWE-121) triggered by input manipulation in the output folder text field. An attacker can overwrite stack memory when the Browse button is clicked, enabling the execution of arbitrary code, such as a bind shell on TCP port 9999, requiring low privileges and user interaction.

The vulnerability poses a severe risk to system integrity and confidentiality, as successful exploitation results in full control over the application process. With a CVSS score of 8.8, this flaw is considered High severity, as it allows an attacker to bypass security controls, establish persistence, or pivot to other areas of the local system.

Immediate Action: Update AVS Audio Converter to the latest available version provided by the vendor to remediate the buffer overflow.

Proactive Monitoring: Monitor system logs for unauthorized processes or unexpected network connections originating from the AVS Audio Converter application, specifically looking for traffic on port 9999.

Compensating Controls: Restrict application execution permissions to authorized users only and ensure that the software is run within a least-privilege environment to limit the potential impact of code execution.

Public Exploit Available: Yes, a proof-of-concept exploit is available via ExploitDB (EDB-ID 47810 and 47788).

Given the availability of public proof-of-concept code and the ease of triggering the overflow, organizations should prioritize updating the software immediately. If an update is not currently possible, ensure the application is restricted from untrusted users and monitor for suspicious process activity.