InputMapper 1.6.10 contains a buffer overflow in the username field that causes the application to crash when a locally privileged attacker supplies an overly long string and triggers processing. The vulnerability is a classic example of resource exhaustion (CWE‑770), leading to a local denial of service without affecting confidentiality or integrity or allowing remote code execution.

The affected product is InputMapper issued by DSD Consulting Services LLC. The specific vulnerable release is 1.6.10; no other affected versions are explicitly listed.

The CVSS score of 6.7 indicates moderate severity. However, the EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, suggesting a low likelihood of widespread exploitation. The attack vector is local; an attacker must run code on the affected machine to trigger the crash. No steps for privilege escalation or remote exploitation are described in the data.