CVE-2023-40036
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
Notepad++ versions 8.5.6 and prior are vulnerable to global buffer read overflow in `CharDistributionAnalysis::HandleOneChar`. Exploitation of this issue may lead to leaking internal memory allocation information.
Risk Assessment
Organizations may be exposed to sensitive information leaks from memory, potentially leading to further attacks or security breaches.
Recommendation
It is recommended to monitor for available updates for Notepad++ and consider using alternative code editors until patches are released.
Original NVD description (English source)
Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to global buffer read overflow in `CharDistributionAnalysis::HandleOneChar`. The exploitability of this issue is not clear. Potentially, it may be used to leak internal memory allocation information. As of time of publication, no known patches are available in existing versions of Notepad++.