A local buffer overflow vulnerability in Audio Playback Recorder 3.2.2 allows an attacker to achieve arbitrary code execution by overwriting the Structured Exception Handler.

The application fails to perform adequate bounds checking on the eject and registration input fields: this allows an attacker to trigger a stack-based buffer overflow (CWE-121) and overwrite the Structured Exception Handler (SEH) with malicious shellcode. This exploit requires local access but does not require prior authentication.

The ability to execute arbitrary code with the privileges of the application user poses a total compromise risk to the host system. Given the CVSS score of 8.4, this vulnerability represents a high-severity risk: successful exploitation could lead to full system takeover, unauthorized access to sensitive audio files, or the installation of persistent malicious software.

Immediate Action: Discontinue the use of Audio Playback Recorder 3.2.2 as there is no vendor patch available: if the software is required, restrict access to the host machine to authorized personnel only.

Proactive Monitoring: Monitor system logs for unexpected application crashes or execution of unauthorized processes triggered by the audio recording service.

Compensating Controls: Use Endpoint Detection and Response (EDR) solutions to monitor for suspicious child processes spawned by the application, which may indicate an exploitation attempt.

Public Exploit Available: Yes: a functional proof-of-concept exploit is available via Exploit-DB (EDB-ID: 48796).

The risk associated with this vulnerability is significant due to the availability of public exploit code. Organizations should identify and remove all instances of Audio Playback Recorder 3.2.2 from their environment immediately, as the developer has provided no path for remediation. If the software cannot be uninstalled, ensure the host system is strictly isolated from critical network segments to prevent lateral movement following a potential compromise.