A denial of service vulnerability in GeoGebra Graphing Calculator 6.0.631.0 allows local attackers to crash the application by supplying an oversized input string.

The application fails to properly throttle or limit resource allocation, specifically within an input field. By injecting a payload of 8000 repeated characters, an unauthenticated local attacker can overwhelm the application and force an unresponsive state.

Successful exploitation of this vulnerability results in an application crash, leading to a denial of service for the local user. While the CVSS score of 7.5 indicates a high severity due to the impact on application availability, the risk is localized to the machine where the software is installed. This could disrupt academic or professional workflows that rely on the calculator, causing temporary productivity loss.

Immediate Action: There is no official patch currently documented for this specific version. Users should restrict access to the application on shared systems or upgrade to the latest available version of the GeoGebra suite to determine if the issue has been addressed in subsequent releases.

Proactive Monitoring: Monitor system event logs and application crash reports for recurring termination errors associated with the GeoGebra executable.

Compensating Controls: Since this is a local application, ensure that users operate with the principle of least privilege, limiting the ability of unauthorized local users to interact with sensitive or critical software installations.

Public Exploit Available: Yes, a proof-of-concept exploit is available via ExploitDB (EDB-ID: 49653).

Given the availability of a public proof-of-concept, the risk of localized disruption is elevated. Organizations utilizing GeoGebra Graphing Calculator should prioritize updating to the most recent version provided by the vendor. If an update is not immediately feasible, administrators should monitor for anomalous application behavior on systems where this software is deployed.