An input validation flaw in Pidgin 2.13.0 (and versions 2.14.0–2.14.9) allows a local attacker to crash the program by submitting an unusually long username during account creation. The excessive length of about 1,000 characters causes the application to crash when the user attempts to join a chat, effectively making the messaging client unavailable. The flaw is attributable to improper handling of string input, reflected in CWE-1284 and CWE-807.

The vulnerability affects the open‑source instant messaging client Pidgin, specifically version 2.13.0 and the 2.14.x family from 2.14.0 through 2.14.9. Users running any of these releases on Windows, macOS, or Linux are potentially exposed.

The CVSS score of 6.9 classifies the issue as high‑moderate severity, though the EPSS score of less than 1 % indicates a low likelihood of exploitation. Because the flaw requires a local user to create the malformed username, it is generally limited to compromised or physically accessible systems. The exploit path is straightforward: a local attacker supplies a 1,000‑character username, then attempts to join a chat, triggering a crash. The vulnerability is not listed in the CISA KEV catalog, further suggesting limited public exploitation.