What’s Vulnerable › Vulnerabilities

CVE-2025-52938: Potential heap-based buffer over-read vulnerability in NotepadNext

• Severity: medium (CVSS 5.1 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-23 · updated 2026-06-17
• Weakness: CWE-125

Description

Out-of-bounds Read vulnerability in dail8859 NotepadNext (src/lua/src modules). This vulnerability is associated with program files lparser.C. This issue affects NotepadNext: through v0.11. The singlevar() in lparser.c lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code.

References

• https://github.com/dail8859/NotepadNext/commit/66b8a97d9fdfd2257996875716f39c18d84e004f
• https://github.com/dail8859/NotepadNext/pull/756

Get alerted when CVE-2025-52938 or the next vulnerability affects your stack