Executive brief
NordVPN, a popular virtual private network (VPN) service used to secure internet connections, contains a flaw in its Windows application. An attacker can cause the application to crash by entering an extremely long password during the login process. This results in a denial of service, preventing the user from establishing a secure connection until the application is restarted.
Technical details
A denial of service vulnerability exists in NordVPN for Windows versions 6.14.31 and earlier due to improper handling of large input strings in the authentication interface. The root cause is a memory allocation issue (CWE-789) where the application fails to properly validate the length of the password field before processing. An unauthenticated attacker with local access to the application interface can trigger a crash by pasting a buffer of approximately 100,000 characters into the password field. This results in an application hang or crash, though there is no evidence of remote code execution. Users should update to the latest version of the NordVPN client to mitigate this issue.
Affected products
- Nord Security NordVPN <= 6.14.31
Timeline
- 2018-08-30: disclosed: Initial proof of concept published on Exploit-DB
- 2026-05-25: advisory: CVE record published/updated by VulnCheck