Streambert versions before 2.5.0 contain an improper input validation vulnerability (CWE-20) in the run-download IPC handler. This allows an attacker who has compromised the renderer process to execute arbitrary local executables with the application's privileges, potentially leading to full system compromise. The vulnerability is patched in version 2.5.0. No known exploits are reported in the wild as of the published date.

Successful exploitation enables execution of arbitrary local binaries with the privileges of the Streambert application, which can lead to complete system compromise including confidentiality, integrity, and availability impacts. The CVSS 3.1 base score is 10.0, reflecting network attack vector, no required privileges or user interaction, and complete impact on confidentiality, integrity, and availability.

Upgrade Streambert to version 2.5.0 or later, which contains the official patch for this vulnerability. No other mitigations are indicated by the vendor advisory. Patch status is confirmed by the version information in the description.