This flaw allows a local attacker to crash the Watchr application by submitting an excessively long string into its search bar, resulting in a denial of service. The vulnerability arises from uncontrolled buffer consumption, as indicated by its CWE‑1260 classification. Because the crash is triggered by a specific user action, an attacker would be limited to local denial of service on the machine running the software.

The affected product is Watchr version 1.1.0.0. No additional versions are listed. Users running this release should verify whether the vendor has issued a patch or newer version.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score is not available, providing no insight into exploit probability. This vulnerability is not listed in the CISA KEV catalog, suggesting it is not currently known to be exploited in the wild. The attack vector is local, requiring the attacker to be able to interact with the application’s search feature. Based on the description, it is inferred that the attacker must have local access to the machine. While the vulnerability only causes a service crash and does not expose confidentiality or integrity risks, repeated crashes could create a denial‑of‑service scenario in environments with multiple users or high availability demands.