Notepad++ is one of the most popular free and open-source text editors for Windows, used by developers and everyday users alike. However, if you’re using version 8.5.6 or any earlier release, there’s something you need to know: a recent vulnerability has been discovered that could potentially put your information at risk.

What is CVE-2023-40166?

CVE-2023-40166 is a security vulnerability in Notepad++ (versions 8.5.6 and prior) that leads to a heap buffer read overflow. In technical terms, this means the program may read memory contents it’s not supposed to when handling certain text files. This bug lives inside the FileManager::detectLanguageFromTextBegining function, which tries to automatically figure out what kind of code or text you are opening.

The full official summary can be found in

- NVD CVE-2023-40166 entry
- GitHub Advisory

Let’s break down what this means and show you code examples from the actual source.

Breaking Down the Vulnerable Code

If you look at the Notepad++ source code, the vulnerable logic is in the function responsible for “guessing” the language of a newly opened file by inspecting its content. Here’s a simplified snippet demonstrating the dangerous pattern:

// Simplified vulnerable function
int FileManager::detectLanguageFromTextBegining(const char* buffer, size_t length) {
    if (buffer[] == '[' && buffer[1] == '#') {  // tries to peek first two chars
        // do something...
    }
    // ... more similar direct buffer access ...
}

What’s wrong?
Notice no length check before accessing buffer[1]. If the buffer only has one character (or is even empty), this will attempt to read memory outside of the buffer. This is a classic heap buffer read overflow.

Why Does This Matter?

While this bug isn’t a Code Execution vulnerability (at least, not from what’s currently known), it lets attackers read chunks of memory they shouldn’t be able to by making Notepad++ open a specially crafted file. If an attacker can get you to open such a file, the program might accidentally reveal internal information from memory. In real-world scenarios, attackers often chain these bugs with others to fully break security barriers.

Sample Exploit Scenario

Because no working public exploit script is available, here’s an illustrative Python code that crafts a malicious file:

# A malformed file with insufficient content, possibly triggering the overflow
with open("malformed.txt", "w") as f:
    f.write('[')  # Only a single char; Notepad++ expects at least two

- When Notepad++ tries to check buffer[1], it will read beyond the file’s actual data, possibly pulling random content from memory.

Has it Been Patched?

As of June 2024:
No patches have been released in the official Notepad++ releases for this specific bug. If you are using version 8.5.6 or any previous one, you remain vulnerable.

Do NOT open files from strangers or untrusted sources in Notepad++.

- Watch the Notepad++ GitHub Release page for updates or an official patch.

References

- CVE-2023-40166 at NVD
- GitHub security advisory for Notepad++
- Notepad++ GitHub repository (source code)

Final Thoughts

Even simple, trusted tools like Notepad++ can have serious vulnerabilities. CVE-2023-40166 is a reminder to always keep your software updated and never take file safety for granted. At the moment, caution is your best defense!

If you want to explore this yourself or help patch the bug, Notepad++ is open source — your contribution could make a difference for millions of users.

Timeline

Published on: 08/25/2023 21:15:00 UTC
Last modified on: 08/31/2023 16:33:00 UTC