CVE-2026-54758 in Notepad++
Summary
by MITRE • 08/17/2026
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the expandNppEnvironmentStrs function in PowerEditor/src/WinControls/StaticDialog/RunDlg/RunDlg.cpp copies a Notepad++ variable name between $( and ) into the fixed-size wchar_t str[MAX_PATH] stack buffer without bounding the m loop index, allowing a name of 260 or more characters to corrupt adjacent stack data, terminate the process through __report_gsfailure, and potentially execute code. This issue is fixed in version 8.9.7.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
Notepad++ is a widely utilized free and open-source source code editor that supports multiple programming languages and offers features such as syntax highlighting, macro recording, and plugin support. The vulnerability identified affects the application prior to version 8.9.7 and centers on a critical memory safety flaw within the PowerEditor component. Specifically, the issue resides in the expandNppEnvironmentStrs function located in the source file RunDlg.cpp under WinControls/StaticDialog/RunDlg/. This function is responsible for processing environment variables that users may invoke through the run dialog interface, typically by entering strings enclosed in dollar signs and parentheses, such as $(APPDATA). The core technical flaw involves an improper handling of buffer boundaries during string expansion operations.
The vulnerability manifests when the expandNppEnvironmentStrs function attempts to copy a Notepad++ variable name into a fixed-size stack buffer defined as wchar_t str[MAX_PATH]. In Windows environments, MAX_PATH is typically set to 260 characters. The code iterates through the input string using an index variable labeled m but fails to validate this index against the maximum capacity of the destination buffer before writing data. Consequently, if a user provides a variable name that exceeds or equals 260 characters in length, the loop continues to write beyond the allocated memory space of str[MAX_PATH]. This lack of bounds checking results in a stack-based buffer overflow, where adjacent memory locations on the call stack are overwritten with arbitrary data derived from the oversized input.
The operational impact of this vulnerability is severe due to the nature of stack corruption. When the program attempts to return from the function or access corrupted local variables, it triggers an integrity check failure detected by __report_gsfailure. This security mechanism immediately terminates the process to prevent further exploitation in many standard configurations. However, under specific conditions where the attacker can control the content written into adjacent memory, this buffer overflow could potentially be leveraged for arbitrary code execution. By carefully crafting the input string, an attacker might overwrite critical stack data such as return addresses or function pointers, thereby redirecting program flow to malicious shellcode injected via the same vulnerable variable name mechanism. This aligns with Common Weakness Enumeration (CWE) category CWE-121, which describes a stack-based buffer overflow resulting from writing more data than the buffer can hold.
From an attack perspective, this vulnerability allows for local exploitation if the user interacts with the run dialog and inputs maliciously crafted environment variable strings. It does not require remote interaction or network access but relies on social engineering or automated scripts that trigger the specific UI component within Notepad++. The behavior is consistent with CWE-787, which highlights out-of-bounds write vulnerabilities in C/C++ applications where memory safety checks are absent. Furthermore, while this specific instance results in a crash via __report_gsfailure, the underlying mechanism represents a classic exploitation vector for control flow hijacking, similar to techniques observed in ATT&CK tactic TA0002 (Execution) and sub-techniques involving local process manipulation or DLL sideloading if combined with other vulnerabilities.
Mitigation strategies primarily involve upgrading Notepad++ to version 8.9.7 or later, where the developers have implemented proper bounds checking for the loop index m relative to the MAX_PATH limit. For organizations unable to upgrade immediately, restricting user privileges and disabling macro execution can reduce the attack surface. Additionally, enabling Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) on Windows systems provides layers of defense that make successful exploitation significantly more difficult by preventing code execution in non-executable memory regions and randomizing base addresses respectively. Security teams should also monitor for unusual process terminations or crashes associated with the Notepad++ executable as an indicator of attempted exploitation activity.