Medium severity · published Aug 25, 2023
CVE-2023-40166
Notepad++ heap buffer read overflow in FileManager::detectLanguageFromTextBegining
5.5
CVSS
0.4%
EPSS
No
On KEV
Description
Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to heap buffer read overflow in `FileManager::detectLanguageFromTextBegining `. The exploitability of this issue is not clear. Potentially, it may be used to leak internal memory allocation information. As of time of publication, no known patches are available in existing versions of Notepad++.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NO
notepad-plus-plus · notepad-plus-plus
<= 8.5.6 · source: vendor
NO
Notepad++ · Notepad-plus-plus
through 8.5.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-40166
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-40166
Exploit
https://securitylab.github.com/advisories/GHSL-2023-092_Notepad__/
More from notepad-plus-plus
7.5
CVE-2025-15556
Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification
8.6
CVE-2026-85279
Notepad++: Stack Buffer Overflow in Plugin Lexer Loading via Unchecked GetLexerCount() Return Value
8.1
CVE-2026-57233
Notepad++: Path Traversal (Zip Slip) in WinGup Plugin Extraction
7.8
CVE-2026-77605
Notepad++ “Run by system” executes *.txt.cmd when user selected *.txt (target confusion → command execution)
7.8
CVE-2026-86054
Notepad++: Stack Buffer Overflow in `NppParameters::writeSession` via overlong session path