Executive brief
My Notes Safe is a mobile application used for storing and securing personal notes. A vulnerability in version 5.3 allows the application to be crashed by entering an excessively long string of text into a note field. This results in a denial of service, preventing the user from accessing their stored information until the application is restarted or recovered.
Technical details
A denial of service vulnerability exists in My Notes Safe version 5.3 (and potentially earlier) due to improper handling of large memory allocations (CWE-789). The application fails to validate the length of input when creating or editing a note. An attacker can trigger an application crash by pasting a payload of approximately 700,000 characters (e.g., two instances of a 350,000 character string) into a note field. This issue was demonstrated on iOS 14.2 and is caused by the application attempting to process or allocate memory for a string of excessive size, leading to a crash.
Affected products
- My Notes Safe My Notes Safe 5.3 and earlier
Timeline
- 2021-06-04: disclosed: Original proof of concept published on Exploit-DB
- 2026-05-16: advisory: NVD and VulnCheck published formal advisory details