CVE-2023-40166

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to heap buffer read overflow in `FileManager::detectLanguageFromTextBegining `. The exploitability of this issue is not clear. Potentially, it may be used to leak internal memory allocation information. As of time of publication, no known patches are available in existing versions of Notepad++.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-120 CWE-122

Affected software

No affected versions have been published.

Timeline

Published: Aug 25, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-401675.3Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character CVE-2023-401686.5TurboWarp is a desktop application that compiles scratch projects to JavaScript. TurboWarp Desktop versions prior to version 1.8.0 allowed a CVE-2023-40176.1The Goya theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘attra-color’, 'attra-size', and 'product-cata' parame CVE-2023-401706.1jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on `/files/` URLs could allow exposure of CVE-2023-401717.5Dispatch is an open source security incident management tool. The server response includes the JWT Secret Key used for signing JWT tokens in CVE-2023-401728.8Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. A Cross-site reque CVE-2023-401737.5Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. Prior to version 1 CVE-2023-401749.8Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. Insufficient sessi CVE-2023-401759.8Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chun CVE-2023-401765.4XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any registered user can exploit a s CVE-2023-401778.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any registered user can use the con CVE-2023-401785.3Node-SAML is a SAML library not dependent on any frameworks that runs in Node. The lack of checking of current timestamp allows a LogoutRequ