CVE-2019-16294

HIGH 7.8CVE-2019-16294 · Published 14/09/2019 · updated 17/06/2026

In short

CVE-2019-16294 is a HIGH (CVSS 7.8) vulnerability affecting notepad++ (notepad-plus-plus).
Chance of exploitation in the next 30 days (EPSS): 9.8%, higher than 95.6% of all vulnerabilities.
Fix: update to 7.7 or later.

Package	Affected versions	Patched versions
notepad++ notepad-plus-plus	`< 7.7`	`7.7`

Description

SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode characters in a crafted .ml file.

References

packetstormsecurity.com/files/154706/Notepad-Code-Execution-Denial-Of-Service.html · Third Party Advisory
bi7s/CVE · Exploit
notepad-plus-plus.org/download/v7.7.html · Release Notes
scintilla.org/ScintillaHistory.html · Release Notes

More vulnerabilities in notepad++

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

notepad++

notepad-plus-plus

< 7.7

7.7

More vulnerabilities in notepad++

See all →