Google Researcher Finds Code Execution Vulnerability in Notepad

Google Project Zero researcher Tavis Ormandy revealed on Tuesday that he identified a code execution vulnerability in Microsoft’s Notepad text editor.
 
Ormandy says he has reported his findings to Microsoft and the company has been given 90 days – per Project Zero’s vulnerability disclosure policy – to release a patch. Details of the security hole will be made public after 90 days or possibly sooner if Microsoft rolls out a fix.
 
The researcher has only revealed so far that the vulnerability is a memory corruption and he posted a screenshot showing how he managed to “pop a shell in Notepad.” The screenshot apparently shows that the vulnerability has been exploited to spawn a Windows Command Prompt.
 
Several individuals have speculated on how the flaw may be triggered, but Ormandy has not released any information on the topic. He did, however, clarify that he has developed a “real exploit” for it.
 
Chaouki Bekrar, founder of exploit acquisition firm Zerodium, suggested on Twitter that this is not the only memory corruption vulnerability that can be used to “pwn” Notepad.
 
Ormandy found many vulnerabilities in popular software in the past years, including Microsoft’s Malware Protection Engine, uTorrent, Grammarly, Keeper, Ghostscript, LastPass, Kaspersky Antivirus, and Cisco WebEx.

---