CVE-2023-40166: 
Notepad++ vulnerability analysis and mitigation

Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to heap buffer read overflow in FileManager::detectLanguageFromTextBegining. The vulnerability was discovered and reported by GHSL team member Jaroslav Lobačevski in April 2023, and was assigned CVE-2023-40166 with a CVSS v3.1 score of 5.5 (Medium) (NVD, GitHub Security Lab).

The vulnerability occurs in the FileManager::detectLanguageFromTextBegining function where it advances the data pointer until a non-space character is detected or lenFile is reached. When the latter case occurs, the code continues reading 32 bytes (40 - 8, the extra padding added for incomplete multibyte character case) past the end of the data buffer. This happens because there is no check that the value of i + longestLength is still less than dataLen at the end of the loop (GitHub Security Lab).

The exploitability of this issue is not clear. Potentially, it may be used to leak internal memory allocation information (NVD, Security Online).

As of the time of publication, no known patches are available in existing versions of Notepad++ (NVD).