CVE-2025-52938 | THREATINT

Description

Out-of-bounds Read vulnerability in dail8859 NotepadNext (src/lua/src modules). This vulnerability is associated with program files lparser.C. This issue affects NotepadNext: through v0.11. The singlevar() in lparser.c lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code.

Reserved 2025-06-23 | Published 2025-06-23 | Updated 2025-06-23 | Assigner GovTech CSG

MEDIUM: 5.1CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/S:N/AU:Y/R:A/V:D/RE:M/U:Amber

Problem types

CWE-125 Out-of-bounds Read

Product status

Default status

unaffected

Any version

affected

Credits

TITAN Team (titancaproject@gmail.com) reporter

References

github.com/dail8859/NotepadNext/pull/756 patch third-party-advisory

github.com/...ommit/66b8a97d9fdfd2257996875716f39c18d84e004f patch

cve.org (CVE-2025-52938)

nvd.nist.gov (CVE-2025-52938)

Download JSON