CVE-2019-16294

HIGH

Notepad++ < 7.7 - Remote Code Execution or Denial of Service via Crafted .ml File

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-16294. PoCs published by Bogdan Kurinnoy.

AI-analyzed exploit summary This exploit demonstrates a remote memory corruption vulnerability in Notepad++ (x64) versions before 7.7 via a crafted .ml file. The PoC triggers an access violation in SciLexer.dll, leading to potential remote code execution or denial of service.

Description

SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode characters in a crafted .ml file.

Exploits (1)

exploitdb WORKING POC
by Bogdan Kurinnoy · textdoswindows_x86-64
https://www.exploit-db.com/exploits/47393

This exploit demonstrates a remote memory corruption vulnerability in Notepad++ (x64) versions before 7.7 via a crafted .ml file. The PoC triggers an access violation in SciLexer.dll, leading to potential remote code execution or denial of service.

Classification
Working Poc 90%
Attack Type
Rce | Dos
Complexity
Moderate
Reliability
Reliable
Target: Notepad++ < 7.7 (x64)
No auth needed
Prerequisites: Victim must open a malicious .ml file in vulnerable Notepad++ version
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Release Notes, Vendor Advisory x_refsource_misc
https://notepad-plus-plus.org/download/v7.7.html
Release Notes, Vendor Advisory x_refsource_misc
https://www.scintilla.org/ScintillaHistory.html
Exploit, Third Party Advisory x_refsource_misc
https://github.com/bi7s/CVE/tree/master/CVE-2019-16294

Scores

CVSS v3 7.8
EPSS 0.0983
EPSS Percentile 94.9%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-787
Status published
Products (2)
notepad-plus-plus/notepad\+\+ < 7.7
scintilla/scintilla
Published Sep 14, 2019
Tracked Since Feb 18, 2026