A buffer overflow vulnerability in AIDA64 Extreme 5.99.4900 allows local attackers to execute arbitrary code, posing a significant risk to system integrity.

This is a structured exception handler (SEH) buffer overflow (CWE-787) occurring within the application logging functionality. A local attacker can trigger this condition by supplying a crafted, malicious CSV log file path through the Hardware Monitoring logging preferences, which subsequently leads to arbitrary code execution when the application processes the path.

The ability for a local user to achieve arbitrary code execution represents a total compromise of the affected host. This vulnerability could be leveraged to escalate privileges, install persistent malware, or exfiltrate sensitive hardware monitoring and system configuration data. With a CVSS score of 8.4, the risk is high as it facilitates full system control by an attacker who has gained local access to the machine.

Immediate Action: As no official patch is currently identified for this specific version, users should immediately restrict access to the application configuration settings and avoid loading untrusted log file paths.

Proactive Monitoring: Security teams should monitor endpoint logs for suspicious application crashes, unexpected shell spawns, or unauthorized attempts to modify application configuration files.

Compensating Controls: Implement strict file system permissions on the configuration files used by AIDA64 to prevent unauthorized modification by low-privileged users.

Public Exploit Available: Yes, a published PoC exists (documented in the Exploit-DB entry 46660, which provides a functional Python script for generating malicious payloads).

Given the availability of a public exploit and the high severity of potential code execution, administrators should prioritize the removal or restriction of the vulnerable AIDA64 version. If the software is required for business operations, ensure that the host is hardened against local privilege escalation and that users are strictly limited in their ability to modify application logging preferences.