Executive brief
TaskInfo, a system monitoring tool for Windows, is vulnerable to a local buffer overflow that can cause the application to crash. An attacker with local access to the system can trigger this by entering excessively long text into the software's registration fields. This results in a denial of service, preventing the user from using the application to monitor system performance or manage processes.
Technical details
A local buffer overflow vulnerability exists in Iarsn TaskInfo version 8.2.0.280 due to improper validation of input length in the registration fields. Specifically, an attacker can trigger an out-of-bounds write (CWE-787) by pasting a string of approximately 1,000 characters into the 'New User Name' or 'New Serial Number' textboxes within the Help menu's registration dialog. This action causes the application to crash, resulting in a denial of service condition. The vulnerability requires local access to the application interface but does not require specific user privileges or complex interaction beyond pasting the oversized string. No official patch has been identified in the provided documentation.
Affected products
- Iarsn TaskInfo 8.2.0.280
Timeline
- 2019-01-30: disclosed: Vulnerability discovered by Rafael Pedrero
- 2019-02-04: other: Proof of concept exploit published on Exploit-DB
- 2026-04-05: advisory: NVD and VulnCheck published advisory details