The vulnerability is a string injection flaw that permits an attacker to supply crafted strings that are treated as format specifiers. Successful exploitation can reveal memory address information, potentially facilitating further attacks, or cause the application to crash. The primary impact is a compromise of confidential memory data and a loss of application availability.

Notepad++ is affected. Versions prior to the 8.9.4 release are vulnerable; the remediation advises updating to Notepad++ 8.9.4 or later.

The CVSS score of 6.6 indicates moderate risk, and the EPSS score of < 1% shows a very low likelihood of exploitation in the wild. The attack does not appear to be listed in the CISA KEV catalog. Based on the description, the likely attack vector is local input manipulation, but it could also be triggered remotely if a trusted user can influence a string that is processed by the application. Further details on the attack path are not provided in the supplied data.