This vulnerability is an out‑of‑bounds read in Notepad3’s regex engine, leading to a heap buffer overflow when a crafted regular expression is compiled. The overflow permits an attacker to execute arbitrary code, potentially taking full control of the affected system. The weakness corresponds to CWE‑125, which describes incorrect handling of memory read boundaries. The impact is that a local user or a malicious document can compromise confidentiality, integrity, and availability of the host machine.

The affected product is Notepad3 from Rizonesoft. Versions prior to 6.25.714.1 are vulnerable. No other vendors or versions are referenced. Users of earlier builds should verify their version and consider upgrading.

The CVSS score of 9.3 indicates a high risk, with the potential for complete system compromise. The EPSS score is not available, but the lack of a KEV listing does not lower the threat; the flaw remains exploitable under local conditions. The likely attack vector is local exploitation via a malicious file that contains a regex pattern engineered to trigger the overflow. Attackers would need to get the application to process the crafted pattern, which could be achieved by opening a doctored file or link. Consequently, the risk remains significant until the application is updated.