CVE-2023-40031CWE-120CWE-122

Notepad++ vulnerable to heap buffer write overflow in Utf8_16_Read::convert

High · published August 25, 2023

CVSS v3.1
7.8
EPSS
1%
Percentile
43.1
In the wild
Unconfirmed
What it is

Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to heap buffer write overflow in `Utf8_16_Read::convert`. This issue may lead to arbitrary code execution. As of time of publication, no known patches are available in existing versions of Notepad++.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00517 · 43.1th percentile
Weaknesses
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'); CWE-122 · Heap-based Buffer Overflow
Published
2023-08-25T19:49Z
EPSS history
Timeline
  • 25 AUG 19:49Z
    Notepad++ vulnerable to heap buffer write overflow in Utf8_16_Read::convert
    cvelistv5