A buffer overflow vulnerability in Nsasoft GTalk Password Finder 2.2.1 allows an attacker to crash the application, resulting in a denial of service.

This is a classic buffer overflow (CWE-120) triggered by providing an excessively long input, specifically a 1000-character payload, into the Key field during the registration process. The vulnerability can be triggered by an unauthenticated local user or an attacker capable of providing input to the application interface.

While the CVSS score is 7.5, the primary impact is a denial of service, which disrupts the availability of the utility. Although this does not involve remote code execution, the ability to repeatedly crash the software can hinder administrative workflows that rely on the tool for password recovery or auditing, potentially resulting in operational downtime for specific tasks.

Immediate Action: As no official patch is currently available, users should restrict access to the application to authorized personnel only and avoid entering untrusted registration keys.

Proactive Monitoring: Monitor system logs for repeated application crashes or unexpected terminations of the GTalk Password Finder executable.

Compensating Controls: Since this is a local application, ensure that host-based security policies prevent unauthorized users from executing or interacting with the software on sensitive workstations.

Public Exploit Available: Yes, a proof-of-concept exists as documented in ExploitDB entry 47942.

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, organizations should treat this vulnerability as a credible threat to availability. Users should exercise caution when inputting data into the registration module and limit the software installation to hardened endpoints where the risk of unauthorized local interaction is minimized.