NordVPN version 6.14.31 contains a buffer overflow in its password entry field that allows an unauthenticated attacker to crash the client by submitting an excessively long string. The flaw occurs when the user attempts to authenticate with a repeated‑character buffer that exceeds the expected input size, causing the application to terminate and become unavailable. This weakness is categorized as CWE‑789, where unchecked input leads to resource exhaustion and loss of availability.

The affected product is the NordVPN client for macOS, version 6.14.31 as identified in the vendor product group Nordvpn:NordVPN. Only the macOS version is mentioned in the advisory and registry data.

The CVSS score of 8.7 indicates high severity. No EPSS data is available, so current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is remote and does not require authentication: an attacker can simply paste a large password string in the login window to trigger a crash, resulting in denial of service for the end user without affecting confidentiality, integrity, or privilege levels.