A denial of service vulnerability in VPN Browser+ 1.1.0.0 allows unauthenticated attackers to crash the application, resulting in potential service unavailability.

This vulnerability is caused by a lack of input validation within the application search bar, where submitting an excessively large character buffer triggers an unhandled exception. This flaw allows an unauthenticated attacker to remotely terminate the application process.

Successful exploitation of this vulnerability results in a denial of service, rendering the VPN Browser+ application unusable for the affected user. While this does not lead to unauthorized data access or code execution, the disruption of network privacy tools can impact user security and business continuity. Given the CVSS score of 7.5, this is considered a high severity issue that requires attention to maintain system reliability.

Immediate Action: As no official patch is currently available, users should restrict access to the application or avoid using the search functionality until a vendor update is released.

Proactive Monitoring: Security teams should monitor application crash logs and endpoint telemetry for repeated instances of unhandled exceptions or abnormal process termination patterns associated with the search function.

Compensating Controls: Deploy endpoint protection solutions capable of detecting and blocking malicious input patterns or buffer overflow attempts targeting local applications.

Public Exploit Available: Yes, a proof of concept exists via the Exploit-DB entry 46198.

Due to the availability of a public proof of concept and the relative ease of exploitation, users of VPN Browser+ should treat this vulnerability with high priority. Organizations should evaluate the necessity of this software and consider alternative solutions if the vendor does not provide a timely security update. Until a patch is confirmed, minimizing exposure by restricting application use is the recommended path forward.