CyberRota Analysis
AI-GeneratedNotepad++ versions prior to 8.9.7 are vulnerable due to a stack buffer overflow in the expandNppEnvironmentStrs function, which allows an attacker to exploit the fixed-size buffer and potentially execute arbitrary code. This vulnerability can lead to process termination and adjacent stack data corruption, posing a significant risk to users. Organizations using affected versions should prioritize upgrading to version 8.9.7 to mitigate this high-severity threat.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the expandNppEnvironmentStrs function in PowerEditor/src/WinControls/StaticDialog/RunDlg/RunDlg.cpp copies a Notepad++ variable name between $( and ) into the fixed-size wchar_t str[MAX_PATH] stack buffer without bounding the m loop index, allowing a name of 260 or more characters to corrupt adjacent stack data, terminate the process through __report_gsfailure, and potentially execute code. This issue is fixed in version 8.9.7.