CVE-2023-40166CWE-120CWE-122

Notepad++ heap buffer read overflow in FileManager::detectLanguageFromTextBegining

Medium · published August 25, 2023

CVSS v3.1
5.5
EPSS
0%
Percentile
34.7
In the wild
Unconfirmed
What it is

Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to heap buffer read overflow in `FileManager::detectLanguageFromTextBegining `. The exploitability of this issue is not clear. Potentially, it may be used to leak internal memory allocation information. As of time of publication, no known patches are available in existing versions of Notepad++.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00414 · 34.7th percentile
Weaknesses
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'); CWE-122 · Heap-based Buffer Overflow
Published
2023-08-25T20:20Z
EPSS history
Timeline
  • 25 AUG 20:20Z
    Notepad++ heap buffer read overflow in FileManager::detectLanguageFromTextBegining
    cvelistv5