CVE-2026-48770

Katalog CVE

CVSS 5.0 · Medium EPSS 0,14%

Kerentanan Out-of-bounds Read pada notepad-plus-plus notepad++. Skor CVSS 3.1 5.0 (Medium) menurut github.com.

Deskripsi (NVD)

Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, a local process in the same interactive Windows session can send a malformed WM_COPYDATA message to Notepad++ using the COPYDATA_FULL_CMDLINE path. The handler appears to process COPYDATASTRUCT.lpData as an unbounded NUL-terminated wchar_t* instead of enforcing COPYDATASTRUCT.cbData. This vulnerability is fixed in 8.9.6.1.

Rincian

Terbit di NVD

26 Juni 2026

Terakhir diubah

29 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.0 (Medium), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read

EPSS (30 hari)

0,14% peluang dieksploitasi; lebih tinggi dari 3,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-r39g-3mcw-xcg2 exploit · patch · advisory vendor · mitigasi
• https://github.com/notepad-plus-plus/notepad-plus-plus/commit/f20a0888a92ce557a339b833cd9d9d8e97dc797d patch