CVE-2019-25572: medium-severity vulnerability in NordVPN
NordVPN 6.19.6 Denial of Service via Email Field Buffer Overflow
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
NordVPN 6.19.6 crashes when you paste an extremely long text (100,000+ characters) into the email field during login. This allows someone with access to the computer to make the app stop working.
A buffer overflow vulnerability in the email input field allows local attackers to cause a denial of service by submitting an excessively long string exceeding the allocated buffer size. The attack requires local access and user interaction to paste malicious input into the login form, resulting in application crash.
In the same product, most dangerous first.