BlueStacks 4.80.0.1060 contains a vulnerability that allows a local user to cause the application to crash by submitting an oversized input to the search field. The buffer overrun in the search component can be triggered by pasting 100,000 "A" characters, resulting in a denial‑of‑service that terminates the emulator. The issue is catalogued as CWE‑466.

Affected releases span a broad range of BlueStacks versions, from 3.0.0 through 4.80.0.1060, as listed in the Common Platform Enumeration data. Any installation of BlueStacks running a version within this range is vulnerable, regardless of user license or installation setting.

The CVSS base score of 6.9 marks this flaw as moderately severe, but the lack of an EPSS value and its absence from the CISA KEV list suggest that widespread exploitation has not yet been documented. Because the exploit requires only local access and a simple paste operation, it can be performed in shared or compromised environments where an attacker can interact with the user interface.