CVE-2021-47973 Overview
CVE-2021-47973 is a denial of service vulnerability in Sticky Notes Widget version 3.0.6 on iOS. The application crashes when an attacker pastes an excessively long character string into a note field. A proof-of-concept payload containing 350,000 repeated characters, pasted twice into a new note, reliably triggers the crash. The flaw maps to [CWE-789: Memory Allocation with Excessive Size Value], where the application fails to constrain input length before processing. Exploitation requires no authentication and no user interaction beyond the paste operation itself.
Critical Impact
Attackers can crash the Sticky Notes Widget iOS application by inserting an oversized string into a note field, resulting in loss of availability and potential data loss for unsaved notes.
Affected Products
- Sticky Notes Widget 3.0.6 (iOS)
- Earlier versions sharing the same input-handling code path may also be affected
- No vendor-confirmed product list is published in the NVD record
Discovery Timeline
- 2026-05-16 - CVE-2021-47973 published to NVD
- 2026-05-18 - Last updated in NVD database
Technical Details for CVE-2021-47973
Vulnerability Analysis
The vulnerability is a denial of service condition triggered by unbounded input handling in the note creation flow. Sticky Notes Widget 3.0.6 accepts arbitrarily large character strings pasted into a note field without enforcing a length cap. When the application attempts to allocate memory for and render a string of approximately 350,000 repeated characters pasted twice, the process crashes on iOS. The classification under [CWE-789] indicates the application allocates memory based on attacker-supplied size without validation. The Exploit Prediction Scoring System probability is low, consistent with the local interaction needed to deliver the payload through a paste action.
Root Cause
The root cause is missing input length validation on the note text field. The application does not enforce maximum string boundaries before passing the buffer to downstream rendering or storage routines. As a result, oversized inputs exhaust available resources or trigger an unhandled exception inside the UI layer, terminating the application.
Attack Vector
An attacker generates a string of 350,000 identical characters and copies it to the iOS clipboard. The attacker, or a victim tricked into pasting attacker-supplied content, then pastes the string twice into a new note. The application processes the resulting buffer and crashes. Delivery can occur through any channel that places hostile content on the clipboard, including messaging apps, web pages, or shared documents. The vulnerability does not yield code execution, only loss of availability.
No verified proof-of-concept code is reproduced here. Technical details are available in the Exploit-DB entry #49978 and the VulnCheck Denial of Service Advisory.
Detection Methods for CVE-2021-47973
Indicators of Compromise
- Repeated, unexpected crashes of the Sticky Notes Widget process on iOS devices
- iOS crash reports referencing the Sticky Notes Widget bundle identifier with large allocation traces
- Clipboard contents containing extremely long repeated character sequences before a crash event
Detection Strategies
- Inspect iOS device crash logs for repeated termination of Sticky Notes Widget tied to memory or allocation failures
- Correlate user reports of application instability with shared content received from external sources
- Monitor mobile device management (MDM) telemetry for elevated crash counts on the affected application version
Monitoring Recommendations
- Aggregate iOS crash diagnostics through MDM or unified endpoint management to identify clusters of failures on version 3.0.6
- Track application version inventory and flag devices still running Sticky Notes Widget 3.0.6
- Review mobile threat defense alerts for anomalous clipboard payload sizes when such telemetry is available
How to Mitigate CVE-2021-47973
Immediate Actions Required
- Identify all iOS devices running Sticky Notes Widget 3.0.6 through MDM inventory queries
- Instruct users to avoid pasting untrusted or unusually long content into notes until a fix is applied
- Remove or disable the application on devices where it is not business-critical
Patch Information
The NVD record does not list a vendor-supplied patch or fixed version. Administrators should consult the VulnCheck advisory and the App Store listing for any updated release before redeploying the application.
Workarounds
- Uninstall Sticky Notes Widget 3.0.6 from managed iOS fleets until a patched version is published
- Restrict installation of the application via MDM application allow-lists
- Educate users not to paste content from untrusted sources into the note field
- Maintain regular backups of note data through iOS backup mechanisms to limit data loss from crashes
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
