SpotPaltalk 1.1.5 contains a denial of service vulnerability in the registration code input field that allows a local attacker to crash the application by submitting an excessively long string. The attacker can paste a buffer of 1000 characters into the Name/Key field during registration to trigger a crash when the OK button is clicked. Based on the description, it is inferred that the attacker would need local access to the machine running the application in order to supply the long input, so the vulnerability is not exploitable remotely. The result of the crash is loss of availability for any user attempting to use the registration feature, thereby disrupting normal application operation.

The affected product is SpotPaltalk version 1.1.5, developed by Nsauditor. No other versions are listed as affected, so the impact is confined to this specific release.

The CVSS score of 6.8 indicates moderate severity. No EPSS score is provided, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is local, requiring the attacker to have access to the host running the application. Because the exploit involves only the input of a long string, the likelihood of exploitation on systems exposed to untrusted users could be relatively high, though it does not represent a remote threat.