CVE-2021-47824
Published: 16 January 2026
Summary
CVE-2021-47824 is a medium-severity Improper Validation of Specified Quantity in Input (CWE-1284) vulnerability in Splinterware (inferred from references). Its CVSS base score is 4.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 28.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2021-47824 is a denial of service vulnerability in iDailyDiary version 4.30. The flaw enables attackers to crash the application by overflowing the preferences tab name field, specifically through pasting a 2,000,000 character buffer into the default diary tab name field.
The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning it can be exploited remotely over the network with low attack complexity, no privileges or user interaction required, and results in high availability impact without affecting confidentiality or integrity. Remote attackers without authentication can trigger the crash, denying service to users of the affected application.
References include a proof-of-concept exploit published on Exploit-DB (https://www.exploit-db.com/exploits/49898), the vendor site at Splinterware (https://www.splinterware.com/index.html), and a VulnCheck advisory detailing an iDailyDiary denial-of-service PoC (https://www.vulncheck.com/advisories/idailydiary-denial-of-service-poc). Security practitioners should review these sources for any available patches or mitigation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2884
Vulnerability details
iDailyDiary 4.30 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the preferences tab name field. Attackers can paste a 2,000,000 character buffer into the default diary tab name to trigger an application crash.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in preferences field directly enables application crash via exploitation, matching T1499.004 Endpoint DoS.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Validates the format, type, range, and length of inputs to reject oversized buffers like the 2,000,000 character tab name that causes the application crash.
Protects against denial-of-service events by limiting the effects of buffer overflow attacks that crash the application remotely.
Requires identification, reporting, and timely correction of flaws such as the buffer overflow vulnerability in iDailyDiary version 4.30.