CVE-2012-2614

CVE-2012-2614 describes a buffer overflow vulnerability in Lattice Diamond Programmer 1.4.2, specifically within the programmer.exe component. This flaw allows user-assisted remote attackers to trigger a denial of service (application crash) and potentially execute arbitrary code by supplying an overly long string in the version attribute of an ispXCF element within a specially crafted .xcf file. With a CVSS score of 6.8, it is a medium-severity vulnerability requiring user interaction (AC:M) but can be exploited remotely (AV:N), leading to partial confidentiality, integrity, and availability impacts (C:P/I:P/A:P). While not listed on CISA's KEV catalog and showing no active exploitation or significant community discussion, a Proof-of-Concept exploit is publicly available on ExploitDB.