Executive brief
Macaron Notes, a digital notebook application for iOS, is vulnerable to a flaw that allows the application to be crashed. By inputting an excessively long string of characters into a note field, a user can trigger a memory error that causes the app to stop functioning. This results in a denial of service, preventing users from accessing or creating notes until the application is restarted or the problematic data is removed.
Technical details
A denial of service vulnerability exists in Macaron Notes version 5.5 due to improper handling of large input strings, classified as CWE-789 (Memory Allocation with Excessive Size Value). An attacker can trigger the vulnerability by pasting a payload of approximately 350,000 characters into a note field. This excessive input causes the application to exhaust available resources or encounter a buffer-related crash, leading to a complete loss of availability for the app on the affected device. The vulnerability was verified on iOS 14.2 and can be reproduced using a simple Python-generated text payload. No authentication is required beyond the ability to interact with the note creation interface.
Affected products
- Macaron Notes Macaron Notes great notebook 5.5
Timeline
- 2021-06-04: disclosed: Original exploit PoC published on Exploit-DB
- 2026-05-16: advisory: NVD and VulnCheck published advisory details