CEWE PHOTO SHOW 6.4.3 suffers a denial of service flaw rooted in an unhandled buffer overrun in the password field. An attacker can submit an excessively long string of repeated characters during the upload process, which causes the application to crash. The weakness is classified as CWE‑836, representing a buffer overflow that directly leads to a loss of availability for legitimate users, with no reported impact on confidentiality or integrity.

The vulnerability affects only the 6.4.3 release of CEWE PHOTO SHOW distributed by Cewe‑Photoworld. No other versions or vendors have been identified as susceptible based on the available data.

The issue carries a CVSS score of 8.7, classifying it as high severity. An EPSS score of less than 1% indicates a low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote via the web‑based upload interface, where an attacker can supply an oversized password field to trigger the crash.