VSCO version 1.1.1.0 contains a flaw that lets a local attacker trigger a denial of service by entering an excessively long string into the search box. The application fails to validate the length of the search text and crashes when a buffer of 5000 characters is submitted, forcing the user to close and restart the program. This weakness falls under CWE‑1260 and affects only the availability of the app, not data confidentiality or integrity.

The vulnerability is limited to the VSCO application released as version 1.1.1.0, as listed by the CNA. All installations of this build, running on Windows devices via the Microsoft Store, are susceptible. No earlier or later releases are known to be affected.

The CVSS score of 6.9 signals moderate to high severity, yet the EPSS score is unknown and the vulnerability is not in CISA’s KEV list, suggesting limited exploitation to date. The flaw requires local access or privileged use of the device; an attacker must have the ability to launch VSCO and enter a long string. The resulting crash merely halts the application, restoring functionality only after a restart, which makes it a moderate operational risk rather than a threat to data or system integrity.