A buffer overflow vulnerability in Nsauditor 3.2.3.0 allows unauthenticated attackers to cause a denial of service by providing a malformed registration key.

The application fails to perform adequate bounds checking on the Key field during the registration process, leading to a classic buffer overflow (CWE-120). An unauthenticated attacker can trigger this condition by inputting a 256-character string into the registration dialog, resulting in an immediate application crash.

Successful exploitation results in a denial of service for the affected Nsauditor instance, rendering the tool unavailable for its intended auditing tasks. While the CVSS score of 7.5 indicates a high severity, the impact is primarily localized to the availability of the application, potentially disrupting security operations that rely on this software.

Immediate Action: Since no official patch is currently identified, users should restrict access to the application registration interface and avoid entering untrusted registration data. Contact the vendor for information regarding a fix or a secure version upgrade.

Proactive Monitoring: Monitor system event logs and application crash dumps for recurring termination events associated with the Nsauditor process.

Compensating Controls: Implement endpoint protection policies to restrict the execution of unauthorized or untrusted software, and utilize application control mechanisms to prevent unauthorized users from interacting with the application registration module.

Public Exploit Available: Yes, a proof-of-concept exploit is available via the Exploit Database (EDB-ID 49965).

Given the availability of a public proof-of-concept and the ease of triggering the crash, users should treat this vulnerability with urgency. If the application is not business-critical, consider uninstalling it until the vendor provides a patched version to eliminate the risk of service disruption.