A buffer overflow vulnerability in DigitalVolcano Software TaskCanvas 1.4.0 allows an unauthenticated attacker to trigger a denial of service condition.

This vulnerability is a classic buffer overflow (CWE-120) located in the registration code input field. An unauthenticated attacker can supply an overly long string (1000 characters) to this field, which lacks proper size validation, resulting in an application crash.

Successful exploitation of this flaw leads to a denial of service, effectively rendering the application unusable for legitimate users. While the CVSS score of 7.5 indicates a high severity, the impact is primarily restricted to availability, causing potential business disruption and requiring manual intervention to restore service.

Immediate Action: As no official patch is currently available, users are advised to restrict access to the application and avoid entering untrusted or excessively long registration codes.

Proactive Monitoring: Security teams should monitor system and application logs for repeated unexpected crashes or anomalous input patterns directed at the registration module.

Compensating Controls: Deploy endpoint protection software or host-based intrusion detection systems that can identify and block process-crashing attempts or memory corruption signatures.

Public Exploit Available: Yes, a proof of concept exists via ExploitDB (EDB-ID: 47911).

Given the availability of a functional proof of concept, the risk of exploitation is elevated. Organizations currently utilizing TaskCanvas 1.4.0 should isolate the application from untrusted networks and monitor for signs of attempted exploitation until a vendor-supplied update is available.