TwistedBrush Pro Studio Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in TwistedBrush Pro Studio version 24.06. This vulnerability allows local attackers to crash the application by importing a malformed .srp script file. The issue arises when an .srp file containing an excessively large buffer is imported through the Script Player interface, leading to an application crash.

Impact

Exploitation of this vulnerability causes the application to crash, disrupting any ongoing work or processes.

Reproduction

To reproduce this vulnerability, create a .srp file with a buffer size of approximately 500,000 bytes. This can be done using a Python script that writes the buffer into a file. Once the file is created, open TwistedBrush Pro Studio and navigate to the 'Script Player' interface. Import the 'sample.srp' file and the application will crash upon opening it.