A local buffer overflow vulnerability in Frigate Professional 3.36.0.9 allows attackers to achieve arbitrary code execution by exploiting the Find Computer input field.

This is a classic buffer overflow (CWE-120) triggered within the Find Computer feature. An attacker can provide a specially crafted, oversized string to the computer name input field to overwrite memory and divert program execution, requiring local access to the system.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the host system with the privileges of the application. Given the CVSS score of 8.4, this represents a high-severity risk that could lead to a full system compromise, data theft, or the installation of persistent malicious software.

Immediate Action: Discontinue the use of Frigate Professional version 3.36.0.9 and transition to a supported, secure alternative. Since the software is legacy and no patch is available, removal is the only effective remediation.

Proactive Monitoring: Monitor system logs for unexpected application crashes or the execution of unauthorized processes, such as calculator or other system tools, launched from the context of Frigate3.exe.

Compensating Controls: Ensure that Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) are strictly enforced at the operating system level for all applications.

Public Exploit Available: Yes, a functional proof of concept exists in the form of a Python script published on ExploitDB (EDB-ID 48579).

This vulnerability presents a significant security risk due to the availability of a functional exploit and the nature of the buffer overflow flaw. Organizations currently running Frigate Professional 3.36.0.9 should prioritize the immediate decommissioning of this software, as no vendor-provided patch is available to resolve the underlying code execution issue.