HeidiSQL Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in HeidiSQL version 9.5.0.5196. This vulnerability allows local attackers to crash the application by entering an excessively long file path in the logging preferences. The SQL log file path field can be used to input a buffer-overflow payload, triggering the application crash.

Impact

Exploitation of this vulnerability leads to a crash of the HeidiSQL application, causing a denial-of-service condition.

Reproduction

To reproduce this vulnerability, open HeidiSQL and navigate to 'Preferences' > 'Logging'. Select the option to write the SQL log to a file and paste a long file path into the SQL log file path field. Click 'OK' to save the changes, which will cause the application to crash.