NotepadNext Out-of-Bounds Write Vulnerability

An out-of-bounds write vulnerability has been identified in NotepadNext versions through v0.11. This issue arises in the Lua source modules, specifically within the program files ldebug.C and lvm.C.

Impact

Exploitation of this vulnerability leads to a memory corruption issue, allowing for a write operation outside the intended bounds, which can commonly result in arbitrary code execution or causing a crash.

Reproduction

The vulnerability can be reproduced by manipulating string concatenation operations within the Lua environment of NotepadNext. This can be done by creating a Lua function that generates a string longer than the maximum allowed size, which will trigger the out-of-bounds write when the string is processed by the concatenation function.

Remediation

Users can update to the latest version of NotepadNext, where this vulnerability has been addressed.