Notepad++ Format String Injection Vulnerability in nativeLang.xml Language Pack Allowing Denial-of-Service and Information Disclosure

A format string injection vulnerability has been identified in Notepad++ version 8.9.3. This issue arises in the Find Results panel handler, where attackers can craft a malicious nativeLang.xml language pack file. When this poisoned language pack is used, it triggers format string interpretation during search operations, leading to access violations and potential leakage of stack or register contents. The vulnerability allows for denial-of-service conditions and unauthorized information disclosure.

Impact

Exploitation of this vulnerability causes a denial-of-service condition and allows for unauthorized information disclosure, such as leaking stack or register contents.

Remediation

Users can upgrade to Notepad++ version 8.9.4, which addresses this vulnerability.