CVE-2026-4744

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-4744
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-4744.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-4744
Published
2026-03-24T03:26:11.751Z
Modified
2026-07-15T01:49:13.298271270Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/S:N/AU:N/R:U/V:D/RE:L/U:Amber CVSS Calculator
Summary
Notepad3 Bundled Oniguruma compile_string_node() Heap Buffer Overflow via Crafted Regex Pattern Allows Arbitrary Code Execution
Details

Out-of-bounds Read vulnerability in rizonesoft Notepad3 (‎scintilla/oniguruma/src modules). This vulnerability is associated with program files regcomp.C‎.

This issue affects Notepad3: before 6.25.714.1.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4744.json",
    "cwe_ids": [
        "CWE-125"
    ],
    "cna_assigner": "GovTech CSG"
}
References

Affected packages

Git / github.com/rizonesoft/notepad3

Affected ranges

Type
GIT
Repo
https://github.com/rizonesoft/notepad3
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b7a2f03123b60d012126fb7bacf2ac253cbd60bd
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.25.714.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

RC2_5.*
RC2_5.20.218.2
RC2_6.*
RC2_6.24.109.1
RC3_6.*
RC3_6.24.309.1
RC_3.*
RC_3.18.422.952
RC_4.*
RC_4.18.507.981
RC_5.*
RC_5.18.1003.1309
RC_5.18.1106.1432
RC_5.19.528.2228
RC_5.19.726.2515
RC_5.20.218.2
RC_5.20.829.2
RC_5.21.1109.1
RC_5.21.207.1
RC_5.22.1119.1
RC_6.*
RC_6.23.712.1
RELEASE_4.*
RELEASE_4.18.512.992
RELEASE_5.*
RELEASE_5.19.108.1602
RELEASE_5.19.815.2595
RELEASE_5.20.722.1
RELEASE_5.21.1129.1
RELEASE_5.21.227.1
RELEASE_5.21.905.1
RELEASE_6.*
RELEASE_6.23.203.2
RELEASE_6.24.1221.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-4744.json"