CVE-2026-6539

Katalog CVE

CVSS 4.4 · Medium EPSS 0,19%

Kerentanan Use of Externally-Controlled Format String pada notepad-plus-plus notepad++. Skor CVSS 3.1 4.4 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

Notepad++ 8.9.3 contains a format string injection vulnerability in the Find Results panel handler that allows attackers to cause denial of service and information disclosure by crafting a malicious nativeLang.xml language pack file. Attackers can distribute a poisoned language pack through community channels that triggers format string interpretation when a user performs search operations, leading to access violations and potential leakage of stack or register contents.

Rincian

Terbit di NVD

30 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.4 (Medium), sumber vulncheck.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-134: Use of Externally-Controlled Format String

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 8,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.vulncheck.com/advisories/notepad-format-string-injection-via-nativelang-xml advisory pihak ketiga
• https://notepad-plus-plus.org/news/v894-released/ release notes