CVE-2023-6401: 
Notepad++ vulnerability analysis and mitigation

A vulnerability classified as problematic was found in NotePad++ up to version 8.1. The vulnerability affects an unknown functionality of the file dbghelp.exe and involves an uncontrolled search path element. The issue requires local access for exploitation and was assigned the identifier CVE-2023-6401 (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The issue is classified under CWE-427 (Uncontrolled Search Path Element). The vulnerability specifically involves the dbghelp.exe file and its search path handling (NVD).

If successfully exploited, this vulnerability could lead to high impacts on confidentiality, integrity, and availability of the affected system. The CVSS scoring indicates potential for complete compromise of system confidentiality, integrity, and availability within the scope of the affected component (NVD).

The vulnerability requires local access for exploitation, with low attack complexity and low privileges required. No user interaction is needed for exploitation. As of the disclosure, there were no known public exploits specifically targeting this vulnerability (ManageEngine).

The vulnerability has been addressed in version 8.6 of Notepad++. Users are advised to upgrade to this version or later to mitigate the risk (ManageEngine).

The vendor was reportedly contacted early about this disclosure but did not respond in any way (NVD).