This vulnerability involves improper restriction of operations within the bounds of a memory buffer (CWE-119) in Easy File Sharing HTTP Server 7.2. Specifically, the server fails to validate the length of the Email parameter in POST requests to /sendemail.ghp, resulting in a stack-based buffer overflow. An unauthenticated remote attacker can exploit this flaw to execute arbitrary code with server-level privileges. The CVSS 4.0 base score is 9.3, reflecting high exploitability and impact without requiring authentication or user interaction.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code on the affected server with the same privileges as the server process. This can lead to full compromise of the server, data theft, or further network penetration. The vulnerability is critical due to its high CVSS score and the lack of authentication required for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the affected endpoint (/sendemail.ghp) via network controls or firewall rules to trusted users only. Monitor for unusual activity targeting this endpoint and consider disabling the email sending functionality if feasible.