Notepad3 CVE-2026-4744

The vulnerability resides in the Oniguruma regular expression library (cpe:2.3:a:rizonesoft:notepad3), which is integrated into Notepad3's text processing engine via the scintilla module. The root cause is classified as CWE-125 (Out-of-Bounds Read), a memory safety issue where the regcomp.c component fails to properly validate buffer boundaries during regular expression compilation or pattern matching operations. This type of vulnerability in regex engines typically occurs when the parser processes malformed or specially crafted regex patterns without adequate length checks, allowing reads into adjacent memory regions. The scintilla editing component's reliance on Oniguruma for syntax highlighting and pattern matching makes this a direct attack surface when users open or process untrusted documents containing malicious regex patterns.