TextPad Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in TextPad version 8.1.2. This issue allows local attackers to crash the application by sending an excessively long buffer string through the Run command interface. By pasting a 5000-byte payload into the Command field via the Tools > Run menu, attackers can trigger a buffer overflow that causes the application to crash.

Impact

Exploiting this vulnerability leads to a crash of the TextPad application, causing a denial-of-service condition where the application becomes unresponsive or unavailable.

Reproduction

To reproduce this vulnerability, open TextPad 8.1.2 on a Windows system. Navigate to 'Tools' and select 'Run...'. In the Command field, paste a 5000-byte payload, which can be generated using a simple script that creates a file containing the required buffer size. After pasting the payload, click 'OK' to execute the command. The application will crash shortly after, demonstrating the denial-of-service condition.