NASA OpenVSP 3.16.1 contains a buffer overflow in the geometry name field that allows a local attacker to crash the application. By entering an exceptionally long string—such as a 5,000‑byte payload—into the name input on the Geom browser pod addition interface, the attacker can trigger a denial of service. The impact is a loss of availability of the OpenVSP process for the user.

The vulnerability affects the NASA OpenVSP application at version 3.16.1.

The vulnerability has a CVSS score of 6.9, indicating moderate severity. No EPSS score is available and the issue is not listed in the CISA KEV catalog. As the exploit requires local access and manipulation of the geometry name field, it is suitable for attackers who have the ability to run arbitrary input locally. The lack of a publicly available patch suggests that the risk relies on an organization's chance to patch or mitigate the flaw before an attacker can leverage it.