CVE-2025-52939: 
CBL Mariner vulnerability analysis and mitigation

CVE-2025-52939 is an Out-of-bounds Write vulnerability (CWE-787) in the Lua source modules (ldebug.c and lvm.c) embedded within the NotepadNext text editor, developed by dail8859. It affects all versions of NotepadNext through v0.11. The vulnerability was published on June 23, 2025, and assigned by GovTech CSG. It carries a CVSS v4.0 base score of 9.4 (Critical) (Feedly, EUVD).

The root cause is improper stack management in two Lua runtime source files bundled with NotepadNext. In lvm.c, the luaV_concat function fails to properly pop strings from the Lua stack before calling luaG_runerror on a string length overflow condition, and uses a relative decrement (L->top -= n-1) instead of an absolute assignment, which can result in an out-of-bounds write to the Lua stack. In ldebug.c, the luaG_runerror function adds source/line information via luaG_addinfo without subsequently removing the intermediate msg value from the stack, causing stack growth beyond intended bounds. The fix (merged April 28, 2025 in PR #757) adds proper stack cleanup: popping strings before error propagation in lvm.c and using setobjs2s/L->top-- to remove the extra stack entry in ldebug.c (GitHub PR #757, GitHub Commit). This vulnerability is related to the previously known CVE-2022-33099 in the Lua runtime.

Successful exploitation could allow an attacker with local access to trigger an out-of-bounds write in the Lua interpreter's stack, potentially leading to arbitrary code execution, memory corruption, or application crash. The CVSS v4.0 assessment rates confidentiality, integrity, and availability impacts as HIGH for both the vulnerable component and the surrounding system scope, indicating potential for complete compromise of the affected host (Feedly). The attack requires no privileges and no user interaction, and is rated as automatable.

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Users should update NotepadNext to a version that includes the fix merged in commit 3e928d9 (post-v0.11), which addresses the stack management flaws in ldebug.c and lvm.c (GitHub Commit). Until a patched release is available, organizations should restrict local access to the application, apply application whitelisting, and consider temporarily removing NotepadNext from sensitive systems. Monitoring for unusual process behavior originating from NotepadNext is also advisable as a precautionary measure (Feedly).

The vulnerability was assigned by GovTech CSG and tracked by Red Hat, ENISA (EUVD-2025-18873), and Tenable (Nessus plugin 242022), indicating standard industry tracking without notable public controversy or widespread media coverage (Red Hat, Tenable, EUVD). No significant researcher commentary or social media discussion has been identified beyond routine vulnerability database entries.