CVE-2023-40164 Vulnerability Details

  /     /     /  

CVE-2023-40164 Metadata Quick Info

CVE Published: 25/08/2023 | CVE Updated: 02/10/2024 | CVE Year: 2023
Source: GitHub_M | Vendor: notepad-plus-plus | Product: notepad-plus-plus
Status : PUBLISHED

---

CVE-2023-40164 Description

Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to global buffer read overflow in `nsCodingStateMachine::NextStater`. The exploitability of this issue is not clear. Potentially, it may be used to leak internal memory allocation information. As of time of publication, no known patches are available in existing versions of Notepad++.

Metrics

CVSS Version: 3.1 | Base Score: 5.5 MEDIUM
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

l➤ Exploitability Metrics:
    Attack Vector (AV)* LOCAL
    Attack Complexity (AC)* LOW
    Privileges Required (PR)* NONE
    User Interaction (UI)* REQUIRED
    Scope (S)* UNCHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* HIGH
    Integrity Impact (I)* NONE
    Availability Impact (A)* NONE

Weakness Enumeration (CWE)

CWE-ID: CWE-120
CWE Name: CWE-120: Buffer Copy without Checking Size of Input ( Classic Buffer Overflow )
Source: notepad-plus-plus

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description: