EUVD-2026-25775Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Format string safety
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 27, 2026
String injection in Notepad++ 8.9.3 leads to memory address disclosure or application crash when processing maliciously crafted input. Attackers can leverage this remotely without authentication (CVSS 4.0 score 10.0, AV:N/PR:N), though desktop application context suggests user interaction required despite UI:N in vector. Publicly available exploit code exists per GitHub repository llgsjsm/cve-2026-3008. Fixed in version 8.9.4 release candidate per community forum discussion. EPSS data not available for 2026 CVE.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Notepad gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
Successful exploitation of the string injection vulnerability could allow an attacker to obtain memory address information or crash the application.
Articles & Coverage 1
Executive ViewAI
Notepad++ version 8.9.3 contains a critical string injection vulnerability (CVSS 10.0) that enables remote memory disclosure or application crashes through maliciously crafted input without authentication. Users opening untrusted files or content face immediate risk of information leakage or service disruption, potentially exposing sensitive data resident in application memory.
Within 24 hours: Advise users to avoid opening untrusted Notepad++ files and disable auto-open features if available. Within 7 days: Upgrade all Notepad++ installations to version 8.9.4 release candidate or later when stable release is available; verify deployment via inventory scan. Within 30 days: Confirm completion of upgrades to version 8.9.4 stable release once published; document baseline for future patch cycles.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict Notepad++ to trusted content sources only; implement application whitelisting to prevent execution of untrusted file types; educate users on phishing and malicious file risks; monitor process execution logs for anomalous Notepad++ activity. Await stable release of version 8.9.4.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Buffer overflow in NotePad++ 6.6.9 allows remote attackers to have unspecified impact via a long Time attribute in an Ev
Notepad++ versions prior to 8.8.9 contain an update integrity verification vulnerability (CVE-2025-15556) when using the
memono Notepad 4.2 contains a denial of service vulnerability that allows attackers to crash the application by pasting
An Untrusted search path vulnerability in notepad++ 6.5 allows local users to gain escalated privileges through the msim
Notepad++ is a free and open-source source code editor. Rated high severity (CVSS 7.8), this vulnerability is no authent
Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerable dll (Ux
SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode ch
Notepad++ versions before 8.9.2 allow local code execution through an unsafe search path vulnerability that permits atta
Notepad++ v8.4.1 was discovered to contain a stack overflow via the component Finder::add(). Rated medium severity (CVSS
Notepad++ is a free and open-source source code editor. Rated medium severity (CVSS 5.5), this vulnerability is no authe
Notepad++ is a free and open-source source code editor. Rated medium severity (CVSS 5.5), this vulnerability is no authe
Notepad++ is a free and open-source source code editor. Rated medium severity (CVSS 5.5), this vulnerability is no authe
Exploit-DB