CVE-2019-16294

HIGH
Published Sep 14, 20196y ago · Modified Jun 17, 20261w ago
7.8 CVSS 3.1
High
Find Similar
Published Sep 14, 2019 6y ago
Last Modified Jun 17, 2026 1w ago

Description

SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode characters in a crafted .ml file.

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 1

CWE-787 Out-of-bounds Write Memory Safety

Affected Products 2

VendorProductVersionRange
notepad-plus-plusnotepad\+\+* <7.7
scintillascintilla*any

References 4

  • packetstormsecurity.com http://packetstormsecurity.com/files/154706/Notepad-Code-Execution-Denial-Of-Service.html
    Third Party AdvisoryVDB Entry
  • github.com https://github.com/bi7s/CVE/tree/master/CVE-2019-16294
    ExploitThird Party Advisory
  • notepad-plus-plus.org https://notepad-plus-plus.org/download/v7.7.html
    Release NotesVendor Advisory
  • scintilla.org https://www.scintilla.org/ScintillaHistory.html
    Release NotesVendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.