Executive brief
Sticky Notes Widget is a productivity application for iOS used to create and display digital notes. A vulnerability in version 3.0.6 allows the application to be crashed by inputting an excessively long string of text into a note field. This results in a denial of service, rendering the application unusable for the user until it is restarted or the malicious data is removed.
Technical details
A denial of service vulnerability exists in Sticky Notes Widget version 3.0.6 for iOS due to improper memory allocation (CWE-789) when handling large text inputs. An attacker can trigger an application crash by pasting a payload of approximately 700,000 characters (e.g., 350,000 characters pasted twice) into a new note field. This excessive input causes the application to fail while attempting to process or render the string. The vulnerability is exploitable via local user interaction on the device. While the CVSS vector provided by the CNA indicates a network attack vector, the practical exploit requires the user to manually paste the string into the app's interface.
Affected products
- Sticky Notes Widget Sticky Notes Widget 3.0.6 and earlier
Timeline
- 2021-06-07: disclosed: Initial discovery and PoC development by Geovanni Ruiz
- 2021-06-10: other: Exploit published on Exploit-DB
- 2026-05-16: advisory: NVD/VulnCheck advisory published and CVE assigned