« Volver al listado

CVE-2026-3008

Estado: Pendiente de análisisMedia (6.6)—

Successful exploitation of the string injection vulnerability could allow an attacker to obtain memory address information or crash the application.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-3008",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-3008",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-04-27T13:09:36.243190Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.6,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
      "affectedData": [
        {
          "vendor": "Notepad++",
          "product": "Notepad++",
          "versions": [
            {
              "status": "affected",
              "version": "8.9.3"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-04-27T07:16:03.597",
  "references": [
    {
      "url": "https://community.notepad-plus-plus.org/topic/27500/notepad-v8-9-4-release-candidate",
      "source": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4"
    },
    {
      "url": "https://github.com/llgsjsm/cve-2026-3008",
      "source": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4"
    },
    {
      "url": "https://github.com/notepad-plus-plus/notepad-plus-plus/issues/17960",
      "source": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4"
    },
    {
      "url": "https://llgsjsm.github.io/cve-2026-3008/",
      "source": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4"
    },
    {
      "url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-044/",
      "source": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4"
    },
    {
      "url": "https://github.com/llgsjsm/cve-2026-3008",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-134"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Successful exploitation of the\nstring injection vulnerability could allow an attacker to obtain memory address\ninformation or crash the application."
    }
  ],
  "lastModified": "2026-06-17T10:42:52.400",
  "sourceIdentifier": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4"
}