Executive brief
Sticky Notes & Color Widgets is a mobile application used for creating digital notes and home screen widgets. A vulnerability in the app allows it to be crashed by inputting excessively long strings of text into a note field. This results in a denial of service, making the application unresponsive and preventing users from accessing their notes.
Technical details
A denial of service vulnerability exists in Sticky Notes & Color Widgets version 1.4.2 (and potentially earlier) due to improper handling of large input strings, classified as CWE-789 (Memory Allocation with Excessive Size Value). An attacker can trigger an application crash by pasting a large payload of repeated characters (approximately 700,000 characters or more) into a new note field. This excessive memory allocation causes the iOS application to become unresponsive or terminate unexpectedly. The vulnerability was verified on iOS 14.2 using a Python-generated payload. No official patch has been confirmed in the provided advisory.
Affected products
- Sticky Notes & Color Widgets Sticky Notes & Color Widgets 1.4.2 and earlier
Timeline
- 2021-06-04: disclosed: Vulnerability discovered and PoC created by Geovanni Ruiz
- 2021-06-07: other: Exploit published on Exploit-DB
- 2026-05-16: advisory: CVE-2021-47972 published by NVD/VulnCheck