A denial of service vulnerability in Code::Blocks 20.03 allows an attacker to crash the application by submitting a specifically crafted payload into the search interface.

This is a resource exhaustion vulnerability (CWE-770) occurring in the FSymbols search field. An attacker can trigger an application crash by pasting a large payload consisting of 5000 repeated characters into the input field, which requires no specific authentication to execute locally.

Successful exploitation results in an immediate application crash, causing a denial of service for the user of the software. While the impact is limited to the local instance, it disrupts development workflows and productivity. The CVSS score of 7.5 reflects the potential for service disruption, though the local vector restricts the attack surface to users with physical or remote desktop access to the workstation.

Immediate Action: There is no official patch currently available for this specific version of Code::Blocks. Users should avoid pasting untrusted or excessively long strings into the FSymbols search field until a vendor update is released.

Proactive Monitoring: Monitor system logs for unexpected application crashes or termination events associated with the codeblocks.exe process.

Compensating Controls: Ensure that the host machine running the software is protected by standard endpoint security controls to prevent unauthorized local or remote access.

Public Exploit Available: Yes, a proof of concept exists via ExploitDB (EDB-ID: 48617).

While the risk is constrained to local denial of service, organizations utilizing Code::Blocks 20.03 should remain aware of this limitation. Given the lack of a vendor patch, developers should practice defensive input habits and prioritize upgrading to any future versions that address this resource handling flaw once they become available.