Allok AVI to DVD SVCD VCD Converter Buffer Overflow Vulnerability

Allok AVI to DVD SVCD VCD Converter version 4.0.1217 is susceptible to a structured exception handling (SEH) based buffer overflow vulnerability. This vulnerability enables a local attacker to execute arbitrary code by crafting a specific payload. The attack involves providing a malicious string in the License Name field of the application. This can be exploited without requiring any prior authentication, making it a significant security concern for systems running the vulnerable software. The vulnerability was reported on April 29, 2026.

Attack Chain

1. The attacker prepares a malicious string payload consisting of junk data, an NSEH bypass, an SEH handler address, and shellcode.
2. The attacker opens the Allok AVI to DVD SVCD VCD Converter application.
3. The attacker navigates to the registration or license activation section of the software.
4. The attacker pastes the malicious string into the License Name field.
5. The attacker clicks the “Register” button, triggering the buffer overflow.
6. The overflow overwrites the SEH frame, redirecting execution flow to the attacker-controlled NSEH bypass.
7. The NSEH bypass redirects execution to the SEH handler address, which points to the attacker’s shellcode.
8. The shellcode executes, allowing the attacker to run arbitrary code on the system.

Impact

Successful exploitation of this buffer overflow vulnerability allows a local attacker to execute arbitrary code with the privileges of the user running the Allok AVI to DVD SVCD VCD Converter. This could lead to complete system compromise, data theft, or installation of malware. Given the ease of exploitation (no authentication required, local access only) this poses a significant risk to systems with the vulnerable software installed.

Recommendation

• Deploy the Sigma rule Allok AVI Converter SEH Buffer Overflow to detect exploitation attempts based on process creation events.
• Monitor for abnormal process execution originating from the Allok AVI to DVD SVCD VCD Converter application to identify potential exploitation (process_creation).
• Consider removing the Allok AVI to DVD SVCD VCD Converter 4.0.1217 until a patch is available, due to the high severity and ease of exploitation.