Executive brief
Color Notes is a mobile application used for creating and managing digital notes. A vulnerability in version 1.4 allows the application to be crashed by entering an excessively long string of text into a note field. This results in a denial of service, making the application unusable for the user until it is restarted or the malformed data is removed.
Technical details
A denial of service vulnerability exists in Color Notes version 1.4 due to improper handling of large memory allocations (CWE-789). The application fails to validate the length of input when creating a new note, allowing a user to paste a large payload (e.g., 700,000 characters). This excessive input causes the application to exhaust available resources or encounter a memory management error, leading to an immediate crash. The vulnerability has been demonstrated on iOS 14.2 using a repeated character payload. No patch is currently specified in the advisory, though users should avoid pasting untrusted, large blocks of text into the app.
Affected products
- Color Notes Color Notes 1.4 and earlier
Timeline
- 2021-06-04: disclosed: Initial exploit code published to Exploit-DB
- 2026-05-16: advisory: NVD and VulnCheck published advisory details