A local buffer overflow vulnerability in Flexhex River Past Cam Do 3.7.6 allows an attacker to achieve arbitrary code execution on the local host.

This is a local buffer overflow (CWE-434) occurring within the application activation dialog. An unauthenticated local user can trigger this flaw by providing a specially crafted string into the activation code field, which overwrites the structured exception handler chain and leads to code execution.

Successful exploitation of this vulnerability allows a local attacker to execute arbitrary code with the privileges of the user running the application. This could lead to a total compromise of the local system, including the theft of sensitive data, installation of persistent backdoors, or lateral movement within the network. Given the CVSS score of 8.4, this represents a high-severity risk that should be addressed promptly in environments where this legacy software remains in use.

Immediate Action: There is no vendor patch available for this legacy software. Organizations should immediately uninstall River Past Cam Do or restrict access to the application to prevent unauthorized local usage.

Proactive Monitoring: Monitor system logs for unusual process execution or unauthorized attempts to access or modify application configuration files.

Compensating Controls: Ensure that host-based security controls, such as Endpoint Detection and Response (EDR) solutions, are active to detect and block suspicious shellcode execution or memory corruption attempts originating from the application.

Public Exploit Available: Yes, a functional exploit exists via ExploitDB (EDB-ID: 46670).

Due to the lack of vendor support and the availability of a functional local exploit, the primary recommendation is to decommission River Past Cam Do entirely. If the software is strictly required for business operations, it must be isolated from critical network segments and access must be restricted to authorized, trusted users only, while implementing stringent monitoring for anomalous system behavior.