PatchSiren cyber security CVE debrief
CVE-2018-25378 Stokedonit CVE debrief
A denial-of-service vulnerability exists in Notebook Pro 2.0 that allows local attackers to crash the application by supplying an excessively long string in the notebook name field. The vulnerability can be triggered when an attacker creates a malicious text file containing 500 or more characters, pastes the content into the New Notebook Name field, and attempts to create and save the notebook. This results in an application crash, causing availability impact to the affected system. The vulnerability has been assigned a CVSS 4.0 score of 6.9 (MEDIUM severity) with the vector CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. The weakness is categorized as CWE-789 (Uncontrolled Memory Allocation). The CVE was published on May 25, 2026 and last modified on May 26, 2026. The vulnerability status in NVD is currently listed as 'Deferred'.
- Vendor
- Stokedonit
- Product
- Notebook Pro
- CVSS
- MEDIUM 6.9
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-25
- Original CVE updated
- 2026-05-26
- Advisory published
- 2026-05-25
- Advisory updated
- 2026-05-26
Who should care
Organizations using Notebook Pro 2.0 for note-taking or documentation purposes should assess their exposure. Security teams should prioritize identifying installations of this software and implementing compensating controls until a patch is available. End users should be cautious about pasting untrusted content into application fields.
Technical summary
The vulnerability stems from improper handling of user-supplied input length in the notebook name field. When 500 or more characters are supplied, the application fails to properly allocate or manage memory, resulting in a crash. The attack requires local access to the system and user interaction to paste malicious content, but does not require privileges. The attack complexity is low and no user interaction is required beyond the initial paste action. The vulnerability results in high availability impact (VA:H) with no confidentiality or integrity impact.
Defensive priority
medium
Recommended defensive actions
- Review and validate vendor attribution for Notebook Pro 2.0 as current vendor identification is low confidence
- Implement input validation and length restrictions on the notebook name field to prevent buffer overflow or memory allocation issues
- Monitor for patches or updates from the software vendor once properly identified
- Consider application whitelisting or sandboxing to limit local attack vector exposure
- Review application crash logs for indicators of attempted exploitation
Evidence notes
The vulnerability description and technical details are sourced from NVD records with supporting references from Exploit-DB and VulnCheck. Vendor identification is marked as low confidence with 'Unknown Vendor' status, requiring review. The CVSS 4.0 vector and CWE-789 classification are provided in the official NVD metadata.
Official resources
Disclosure details for this vulnerability were provided by [email protected] and published via Exploit-DB and VulnCheck advisory channels.