Medium
Notepad++ global buffer read overflow in CharDistributionAnalysis::HandleOneChar
Type: advisorySources: OSV
Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to global buffer read overflow in `CharDistributionAnalysis::HandleOneChar`. The exploitability of this issue is not clear. Potentially, it may be used to leak internal memory allocation information. As of time of publication, no known patches are available in existing versions of Notepad++.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2023-40036
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 7 Nov 2026, 00:39 UTC · Revision 1
Source evidence
Notepad++ global buffer read overflow in CharDistributionAnalysis::HandleOneChar
core-osv · Original sourcePublished 25 Aug 2023, 19:58 UTC
Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to global buffer read overflow in `CharDistributionAnalysis::HandleOneChar`. The exploitability of this issue is not clear. Potentially, it may be used to leak internal memory allocation information. As of time of publication, no known patches are available in existing versions of Notepad++.
osv:CVE-2023-40036
Complete source record
{
"id": "a9337a97c3353b3abf1015ab5784b7bc5a697e54b5f46bd5c98f3363a2a55b60",
"url": "https://osv.dev/vulnerability/CVE-2023-40036",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Notepad++ global buffer read overflow in CharDistributionAnalysis::HandleOneChar",
"summary": "Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to global buffer read overflow in `CharDistributionAnalysis::HandleOneChar`. The exploitability of this issue is not clear. Potentially, it may be used to leak internal memory allocation information. As of time of publication, no known patches are available in existing versions of Notepad++.",
"evidence": "osv:CVE-2023-40036",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2023-40036",
"aliases": [
"CVE-2023-40036"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/notepad-plus-plus/notepad-plus-plus",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "e39deab7782a89990ac5d3b35f910a33949ea740"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:notepad-plus-plus:notepad\\+\\+:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "8.5.6"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v8.5.6",
"v8.5.5",
"v8.5.4",
"v8.5.3",
"v8.5.2",
"v8.5.1",
"v8.5",
"v8.4.9",
"v8.4.8",
"v8.4.7",
"v8.4.6",
"v8.4.5",
"v8.4.4",
"v8.4.3",
"v8.4.2",
"v8.4.1",
"v8.4",
"v8.3.3",
"v8.3.2",
"v8.3.1",
"v8.3",
"v8.2.1",
"v8.2",
"v8.1.9.3",
"v8.1.9.2",
"v8.1.9.1",
"v8.1.9",
"v8.1.8",
"v8.1.7",
"v8.1.6",
"v8.1.5",
"v8.1.4",
"v8.1.3",
"v8.1.2",
"v8.1.1",
"v8.1",
"v8",
"v7.9.5",
"v7.9.4",
"v7.9.3",
"v7.9.2",
"v7.9.1",
"v7.9",
"v7.8.9",
"v7.8.8",
"v7.8.7",
"v7.8.6",
"v7.8.5",
"v7.8.4",
"v7.8.3",
"v7.8.2",
"v7.8.1",
"v7.8",
"v7.7.1",
"v7.7",
"v7.6.6",
"v7.6.5",
"v7.6.4",
"v7.6.3",
"v7.6.2",
"v7.6.1",
"v7.6",
"v7.5.9",
"v7.5.8",
"v7.5.7",
"v7.5.6",
"v7.5.5",
"v7.5.4",
"v7.5.3",
"v7.5.2",
"v7.5.1",
"v7.4.2",
"v7.4.1",
"v7.4",
"v7.3.3",
"v7.3.2",
"v7.3.1",
"7.3.1",
"v7.3",
"v7.2.2",
"7.2.2",
"v7.2.1",
"v7.2",
"v7.1",
"v7",
"v6.9.2",
"v6.9.1",
"v6.9",
"v6.8.9",
"v6.8.8",
"v6.8.7",
"v6.8.6",
"v6.8.5",
"v6.8.4",
"v6.8.3",
"v6.8.2",
"v6.8.1",
"v6.8",
"v6.7.9.2",
"v6.7.9.1",
"v6.7.9",
"v6.7.8.2",
"v6.7.8.1",
"v6.7.8",
"v6.7.7",
"v6.7.5",
"v6.7.4_-_Je_suis_Charlie_edition",
"v6.7.3",
"v6.7.2",
"v6.7.1",
"v6.7",
"v6.6.9",
"v6.6.8",
"v6.6.7",
"v6.6.6_-_Friday_the_13th_edition",
"v6.6.4",
"v6.6.3",
"v6.6.2",
"v6.6.1",
"v6.6",
"v6.5.5",
"v6.5.4",
"v6.5.3",
"v6.5.2",
"v6.5.1",
"v6.5",
"v6.4.5",
"v6.4.4",
"v6.4.3",
"v6.4.2",
"v6.4.1",
"v6.4",
"v6.3.3",
"v6.3.2",
"v6.3.1",
"v6.3",
"v6.2.3_-_End_of_World_Edition",
"v6.2.2",
"v6.2.1",
"v6.2",
"v6.1.8",
"v6.1.7",
"v6.1.6",
"v6.1.5",
"v6.1.4",
"v6.1.3",
"v6.1.2",
"v6.1.1",
"v6.1",
"v6",
"v5.9.8",
"v5.9.7",
"v5.9.6.2",
"v5.9.6.1",
"v5.9.6",
"v5.9.5",
"v5.9.4",
"v5.9.3",
"v5.9.2",
"v5.9.1",
"v5.9",
"v5.8.7",
"v5.8.6",
"v5.8.5",
"v5.8.4",
"v5.8.3",
"v5.8.2",
"v5.8.1",
"v5.8",
"v5.7",
"v5.6.8",
"v5.6.7",
"v5.6.6",
"v5.6.5",
"v5.6.4",
"v5.6.3",
"v5.6.2",
"v5.6.1",
"v5.6",
"v5.5.1",
"v5.5",
"v5.4.5",
"v5.4.4",
"v5.4.3",
"v5.4.2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-40036.json"
}
}
],
"modified": "2026-10-28T02:30:48.315351580Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40036.json",
"https://nvd.nist.gov/vuln/detail/CVE-2023-40036",
"https://securitylab.github.com/advisories/GHSL-2023-092_Notepad__/"
],
"provider_metadata": {
"cwe_ids": [
"CWE-120"
],
"cna_assigner": "GitHub_M",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"last_affected": "8.5.6"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40036.json"
}
},
"related_cves": [
{
"value": "CVE-2023-40036",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 516684,
"published_at": "2023-08-25T19:58:33.936+00:00"
}