KLA11062 Arbitrary code execution vulnerability in Notepad++

An unspecified vulnerability was found in Notepad++ 7.3.3 with Hex Editor Plugin v0.9.5. By exploiting this vulnerability malicious users can execute arbitrary code. This vulnerability can be exploited remotely via a specially designed file or an untrusted specially designed file from a remote location and issuing several user-defined commands.

Technical details

This vulnerability exists because of a “Data from Faulting Address controls Code Flow” issue.

NB: This vulnerability doesn’t have any public CVSS rating so rating can be changed by the time.

Original advisories

wlinzi on Github

Related products

Notepad++

CVE list

CVE-2017-8803 unknown

Solution

Update to the latest version

Download Notepad++

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

Affected Products

• Notepad++ version 7.3.3