iSelect 1.4.0-2+b1 contains a local buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying an oversized value to the -…

iSelect version 1.4.0-2+b1 contains a local buffer overflow vulnerability in the -k/--key parameter. Local attackers can exploit this by supplying an oversized value that overflows a 1024-byte stack buffer. The vulnerability allows attackers to craft malicious arguments containing NOP sleds, shellcode, and return addresses. Successful exploitation results in arbitrary code execution with user privileges. This represents a significant local privilege escalation risk for systems running the vulnerable iSelect version.