Textpad 8.1.2 allows local attackers to crash the program by supplying an overly long string to the Run command. The overflow occurs when a 5000‑byte payload is entered via Tools > Run, triggering the application to terminate. This is a typical buffer overflow flaw (CWE‑787) that results in a denial of service but does not provide arbitrary code execution or impact beyond the crashed process. The vulnerability is limited to the host running the software and does not expose external network interfaces to remote exploitation.

The affected product is Textpad version 8.1.2. No other versions were reported as vulnerable in the available data. The risk is confined to installations of this specific build and may not extend to later releases.

The CVSS score of 6.9 indicates a moderate severity for local users. EPSS is not provided, so the likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Attackers must be able to run commands locally to trigger the overflow, which typically requires privileged or at least authenticated user access on the machine. No publicly known exploits are documented, but the exploit path is straightforward and reproducible as described in the advisory.