CVE-2023-40036: Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to global buffer read overflow in…

PriorityP424medium5.5CVSS 3.1

AVLACLPRNUIRSUCHINAN

EPSS

0.43%

34.2th percentile

Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to global buffer read overflow in `CharDistributionAnalysis::HandleOneChar`. The exploitability of this issue is not clear. Potentially, it may be used to leak internal memory allocation information. As of time of publication, no known patches are available in existing versions of Notepad++.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
notepad-plus-plus	notepad	<= 8.5.6	—
notepad-plus-plus	notepad-plus-plus	<= 8.5.6	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.