A stack-based buffer overflow in XnSoft XnConvert version 1.82 allows an unauthenticated attacker to cause a denial of service by providing a malformed registration code.

This vulnerability is a stack-based buffer overflow (CWE-121) triggered by an input validation failure within the application registration interface. An unauthenticated attacker can crash the software by inputting a 9000-byte buffer into the registration code field.

The successful exploitation of this vulnerability results in an application crash, which constitutes a denial of service. While this impact is localized to the affected client system, it can disrupt user workflows and negatively impact productivity. Given the CVSS score of 7.5, this is considered a high-severity issue due to the ease of exploitation and the potential for service interruption.

Immediate Action: As there is no official patch available for this legacy issue, users should discontinue use of version 1.82 and upgrade to the latest stable release provided by the vendor.

Proactive Monitoring: Security teams should monitor endpoint security logs for unexpected application terminations or crash reports involving XnConvert.

Compensating Controls: If upgrading is not immediately possible, implement strict access controls on the workstation to prevent unauthorized users from interacting with the application registration module.

Public Exploit Available: Yes, a proof-of-concept exists and is documented in the Exploit-DB entry (EDB-ID 47801).

The presence of a functional proof-of-concept makes this vulnerability a credible risk for systems running the affected version. Organizations should prioritize migrating to a current, supported version of XnConvert to eliminate the overflow condition. If the software cannot be updated, it should be removed from production environments to prevent potential service disruption.