CVE-2026-4744 - Notepad3 Bundled Oniguruma compile_string_node() Heap Buffer Overflow via Crafted Regex Pattern Allows Arbitrary Code Execution

Back Back to CVE browser

CRITICAL

Notepad3 Bundled Oniguruma compile_string_node() Heap Buffer Overflow via Crafted Regex Pattern Allows Arbitrary Code Execution

Published Mar 24, 2026

9.3

CRITICAL

CVSS 4.0

EPSS 0.17%

Description

Out-of-bounds Read vulnerability in rizonesoft Notepad3 (‎scintilla/oniguruma/src modules). This vulnerability is associated with program files regcomp.C‎.

This issue affects Notepad3: before 6.25.714.1.

Affected products

Vendor Rizonesoft Product Notepad3 Default
affected
Affected
- ≥ 0, < 6.25.714.1

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Rizonesoft	Notepad3	affected	Affected ≥ 0, < 6.25.714.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-125

Out-of-bounds Read

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-14702		Advisory
https://github.com/rizonesoft/Notepad3/pull/5392		patch

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner GovTech CSG

Published Mar 24, 2026

Updated Mar 24, 2026

Reserved Mar 24, 2026

Link CVE-2026-4744

CISA Vulnrichment

Updated Mar 24, 2026

NVD

Status Awaiting Analysis

Modified Jun 17, 2026

Link CVE-2026-4744

Red Hat

No data

ENISA EUVD

Assigner GovTech CSG

Published Mar 24, 2026

Updated Mar 24, 2026

Link EUVD-2026-14702

GitHub

No data