A local attacker can cause the NordVPN client to crash by entering an excessively long string—over 100,000 characters—into the email input field during the login process. The overflow triggers a buffer corruption that terminates the application, resulting in loss of availability without compromising data integrity or confidentiality.

The vulnerability specifically affects the Windows version 6.19.6 of the NordVPN client. Other product versions are listed in the CPE data, but the official description only identifies 6.19.6 as impacted.

The flaw has a CVSS score of 6.9, indicating moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Because the exploit requires local access and manual input of an oversized email string, the attack vector is local and non-remote. An attacker with local privileges can easily trigger the crash, leading to repeated service disruption. The risk is therefore moderate but notable for environments where NordVPN usability is essential.