Multiple Notepad++ Flaws Let Attackers Execute Arbitrary Code

In fact, it's not even a 3-byte heap buffer overflow: it's a 1-byte overflow resulting from a 3-byte write operation. The relevant string on the heap is read precisely once, to insert the text into the current document, and freed once the file has finished loading (in the destructor of the Utf8_16_Read object). Therefore, the only thing that can be corrupted is the first byte in the Size field of the _HEAP_ENTRY corresponding to the subsequent object in the heap.

However, some cursory research indicates that the 2 bytes of the Size field are protected (alongside the 1-byte Flags) by an XOR checksum stored in SmallTagIndex. Therefore, the worst it could ever do (unless I am missing something important) is cause an error when that subsequent object is freed.

(Also, that particular write overflow is preceded by a 1-byte read overflow, but since the same buffer is reused for each block in the file, and since the bug can only occur after the first block, the read overflow will always read a byte from earlier in the same file.)

Simplicity. I use VSCode when working on a project, but if I just need to edit a single file I use NPPP.

Vscode? Near instant start times. Macros? Standard column select with just alt.

Sublime? Honestly I can't remember as it's been a while since i used it.

Gedit? 100s ROM standard text operations such as line trims, case replacement, line ending replacement, find in files, replace in files, replace via regex in files, split window of same file, auto save non-saved files, show whitespace from tool bar, opening of very large files quickly, code folding, line numbers shown by default, probably wouldn't print errors when executed in the background on a fresh or updated install for the last 10 years necessitating the redirecting of all output streams thereby hiding possible issues.

And I actually kinda like gedit...

Waiting for the "if we'd all just use emacs" folks to show up.

VsCode, or Codium, which is what I use, does not have a macro facility. That for me is the killer feature of Notepad++. I have no experience with the other editors, but I suspect they also have no macro capability, or if they do it doesn't measure up.

Took a look at it and rejected it pretty much out of hand...don't remember why, but IIRC it doesn't fully implement macros among other things.

I use notepadqq. It does most things I use Notepad++ for in Windows.

That said, I'll switch to Vim for serious text manipulation or an IDE for coding.

Also don't forget geany! It is pretty much the Notepad++ of Linux Desktop world I think.

Kate renders nicely, performs fluidly, opens fast, and never lets you down. I use Notepad++ on Windows as it's work-approved, but Kate where I can.

You can give your texteditor very restricted filesystem access.

With something like flatpak portals you could restrict the directories it has access too. Though it could possibly insert something in the code you will be running unsandboxed.

Then you run the sandbox in itself for extra security

Then run your sandbox on someone else’s computer.

Make the whole computer out of sand.