Microsoft One Search Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Microsoft One Search version 1.1.0.0. This vulnerability allows local attackers to crash the application by sending excessively long input strings to the search feature. By pasting a buffer of 950 or more characters into the search bar, attackers can trigger an unhandled exception that causes the application to crash.

Impact

Exploitation of this vulnerability leads to a crash of the Microsoft One Search application, causing a denial-of-service condition.

Reproduction

To reproduce this vulnerability, paste a string of 950 or more characters into the search bar of Microsoft One Search version 1.1.0.0. After clicking the search button, the application will crash due to an unhandled exception caused by the excessive input length.