A denial of service vulnerability in DupTerminator 1.4.5639.37199 allows unauthenticated local attackers to crash the application by submitting overly long input strings.

The application suffers from a failure to validate the length of user-supplied input in the Excluded text field, categorized as CWE-1284. This allows an unauthenticated attacker to trigger an application crash by providing a crafted payload of 8000 repeated characters.

Successful exploitation results in a denial of service, causing the DupTerminator application to stop responding. While this impact is limited to the local instance, it disrupts workflows and requires manual intervention to restore service. The CVSS score of 7.5 reflects the potential for service disruption, though the local attack vector and limited scope inform the overall risk profile.

Immediate Action: As no official patch is currently available, users should restrict access to the application to trusted users only and avoid entering untrusted or excessively long strings into the Excluded text box.

Proactive Monitoring: Monitor system logs for unexpected application termination events or errors associated with the DupTerminator process.

Compensating Controls: Implement endpoint security policies to restrict the execution of unauthorized or untrusted applications, and utilize local application sandboxing to limit the impact of potential crashes.

Public Exploit Available: Yes, a proof of concept exists on ExploitDB.

Given the availability of a public proof-of-concept, users should prioritize limiting the exposure of the DupTerminator application. Until a vendor-supplied fix is released, administrative controls remain the primary method for mitigating the risk of service disruption.