EIP-2026-118165

This Metasploit module exploits a stack-based buffer overflow in WordTrainer v3.0 via a maliciously crafted .ORD file. It leverages a 'call esp' instruction at 0x00430363 to execute arbitrary payloads, with a payload space of 1500 bytes and specific bad characters excluded.