CVE-2023-40166
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
Notepad++ versions 8.5.6 and prior are vulnerable to heap buffer read overflow in `FileManager::detectLanguageFromTextBegining`. Exploitation of this vulnerability may lead to leaking internal memory allocation information.
Risk Assessment
Organizations may be exposed to the risk of leaking sensitive information from memory, potentially leading to further attacks or security breaches.
Recommendation
It is recommended to update to the latest version of Notepad++ once patches become available. Meanwhile, restricting access to the application may minimize risk.
Original NVD description (English source)
Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to heap buffer read overflow in `FileManager::detectLanguageFromTextBegining `. The exploitability of this issue is not clear. Potentially, it may be used to leak internal memory allocation information. As of time of publication, no known patches are available in existing versions of Notepad++.