A denial of service vulnerability in Splinterware iDailyDiary 4.30 allows local attackers to crash the application by injecting an excessively long string into the preferences tab name field.

The application fails to properly validate the length of user-supplied input in the preferences tab name field (CWE-1284). An attacker can trigger an application crash by pasting a large buffer, approximately 2,000,000 characters, into the default diary tab name field, which requires no specific user privileges to execute.

Successful exploitation of this vulnerability results in a denial of service, rendering the iDailyDiary application unusable for the affected user. While this does not lead to unauthorized data access or remote code execution, it disrupts business productivity and requires a manual application restart to recover. The CVSS score of 7.5 reflects the ease of exploitation, though the impact is strictly limited to local service availability.

Immediate Action: Update to the latest version of iDailyDiary provided by Splinterware, as older versions are confirmed to be vulnerable.

Proactive Monitoring: Monitor system logs for repeated application crashes or unexpected terminations associated with the iDailyDiary executable.

Compensating Controls: Restrict access to the application configuration settings and ensure that only authorized users have the ability to modify diary preferences on shared workstations.

Public Exploit Available: Yes, a proof-of-concept is available via ExploitDB (EDB-ID: 49898).

The vulnerability represents a clear risk to local availability for users of the iDailyDiary software. Given that a functional proof-of-concept is publicly available, administrators should prioritize updating the software to a patched version to prevent potential disruption. Users who cannot update immediately should avoid pasting untrusted or excessively long text into application preference fields.