Sticky Notes Widget 3.0.6 contains a buffer overflow that triggers an application crash when an attacker pastes an excessively long character string into a note field. By generating a payload of 350,000 repeated characters and pasting it twice into a new note, the application on iOS devices will crash, rendering the widget unavailable for users. The vulnerability is identified as CWE‑789: Improper Restriction of Operations within the Bounds of a Memory Buffer.

The affected product is Sticky Notes Widget version 3.0.6 from the vendor sticky-notes. No other versions are listed as impacted.

The CVSS score of 8.7 reflects a high severity of this denial of service flaw. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to supply a very long string into the note field, implying a user‑interaction or social engineering component. While not a remote code execution vulnerability, the crash can disrupt user workflow and potentially be leveraged as a vector for more complex attacks if combined with other weaknesses. The lack of a publicly listed exploit does not diminish the importance of mitigation, especially on iOS deployments where the app may be distributed through corporate channels.