A buffer overflow vulnerability in River Past Video Cleaner 7.6.3 allows a local attacker to execute arbitrary code, creating a risk of complete system compromise.

This is a structured exception handler (SEH) based buffer overflow (CWE-787). An attacker can trigger the flaw by providing a crafted string of 280 bytes of padding followed by a malicious payload in the Lame_enc.dll configuration field, which the application fails to validate.

The vulnerability allows for local arbitrary code execution, which grants an attacker the ability to install software, view or modify sensitive data, and gain full control over the local host. Given the CVSS score of 8.4, this flaw presents a high risk to the confidentiality, integrity, and availability of any system where this software is installed and accessible to local users.

Immediate Action: There is no vendor patch available for this legacy software; users are strongly advised to uninstall River Past Video Cleaner to eliminate the risk.

Proactive Monitoring: Security teams should monitor endpoint logs for unusual child processes spawning from the Video Cleaner executable, such as command shells or unauthorized system tools.

Compensating Controls: Ensure that the application is only accessible to trusted, non-privileged users, and employ Endpoint Detection and Response (EDR) solutions to block unauthorized memory execution attempts.

Public Exploit Available: Yes, a public exploit exists; a local buffer overflow proof-of-concept is documented in the Exploit Database (EDB-ID: 46346).

Due to the availability of functional exploit code and the lack of vendor support, this software poses an unacceptable risk to enterprise environments. Organizations should identify and remove all instances of River Past Video Cleaner from their systems immediately to prevent potential local exploitation.