JAD version 1.5.8e-1kali1 and prior versions contain a critical stack-based buffer overflow vulnerability (CVE-2016-20049) that enables remote code execution. Attackers can exploit this flaw by providing malicious input strings exceeding 8150 bytes, which overflow the stack buffer and overwrite return addresses. This allows attackers to execute arbitrary shellcode within the application context. The vulnerability affects the Java decompiler JAD and has publicly available exploit code. Organizations using affected versions should upgrade immediately to prevent potential compromise.