CVE-2025-34127CWE-121CWE-94

Achat v0.150 SEH Buffer Overflow via UDP

Critical · published July 16, 2025

CVSS v4.0
9.3
EPSS
2%
Percentile
79.3
In the wild
Unconfirmed
What it is

A stack-based buffer overflow exists in Achat v0.150 in its default configuration. By sending a specially crafted message to the UDP port 9256, an attacker can overwrite the structured exception handler (SEH) due to insufficient bounds checking on user-supplied input leading to remote code execution.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01878 · 79.3th percentile
Weaknesses
CWE-121 · Stack-based Buffer Overflow; CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-07-16T21:10Z
EPSS history
Timeline
  • 16 JUL 21:10Z
    Achat v0.150 SEH Buffer Overflow via UDP
    cvelistv5