This vulnerability in VideoCharge Studio 2.12.3.685 is caused by a stack-based buffer overflow triggered when processing a malicious .VSC configuration file. Specifically, the XML 'Name' attribute is improperly handled, allowing an attacker to overwrite Structured Exception Handler (SEH) pointers. Successful exploitation requires a user to open a crafted file, potentially enabling arbitrary code execution with the privileges of the user running the application. The CVSS 4.0 base score is 8.4, indicating high severity with local attack vector, low attack complexity, no privileges required, but user interaction necessary. The vulnerability does not affect cloud services and no patch or vendor advisory has been provided to date.

If exploited, this vulnerability allows an attacker to execute arbitrary code on the affected system with the privileges of the current user. This can lead to compromise of the user's environment, potentially enabling further malicious activities. The requirement for user interaction (opening a malicious file) limits the attack vector to social engineering or targeted delivery of malicious .VSC files. There are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid opening .VSC files from untrusted or unknown sources to mitigate risk. No other specific mitigations are documented.