Outlook Password Recovery 2.10 contains a buffer overflow that allows local attackers to crash the application by supplying an oversized payload. A malicious text file of 6000 bytes can be pasted into the User Name and Registration Code field, triggering a denial of service. This represents a local denial of service due to overflow (CWE-787). Key detail from the description: "Attackers can create a malicious text file containing 6000 bytes of data and paste it into the User Name and Registration Code field to trigger a denial of service condition."

The affected product is Top-Password's Outlook Password Recovery, specifically version 2.10. No additional versions are listed in the CNA data, so the vulnerability is tied to the 2.10 release.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector appears to be local, as the attacker must supply a crafted file to a user running the application. Because the exploit requires user interaction and local access, the overall risk to a network or remote attacker is low, but any compromised workstation could be brought down locally.