VeryPDF Encrypt PDF Buffer Overflow Vulnerability Leading to Denial-of-Service

A buffer overflow vulnerability has been identified in VeryPDF Encrypt PDF version 2.3. This vulnerability allows local attackers to cause a denial-of-service by inputting excessively long strings into password fields. When a 1000-byte buffer is pasted into the User Password or Master Password field in the Settings dialog, the application crashes upon importing PDF files.

Impact

Exploitation of this vulnerability leads to a crash of the Encrypt PDF application, causing a denial-of-service condition.

Reproduction

To reproduce this vulnerability, first run a Python script that generates a 1000-byte buffer and saves it to a text file. Copy the buffer text from the file into the clipboard. Then, open Encrypt PDF version 2.3, navigate to the 'Settings' menu, and paste the clipboard content into either the 'User Password' or 'Master Password' field. After clicking 'OK', import a PDF file, which will trigger the application crash.