A stack-based buffer overflow (Remote Code Execution) issue was discovered in Design Science MathType 6.9c. This occurs in a function call in which the first argument is a corrupted offset value and the second argument is a stack buffer. This is fixed in 6.9d.
https://drive.google.com/open?id=1V-AA1InXBPhgJviabilttkaP4DYay9f6