CVE-2026-85279 in Notepad++
Summary
by MITRE • 09/22/2026
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in PluginsManager::loadPluginFromPath in PowerEditor/src/MISC/PluginsManager/PluginsManager.cpp because the plugin-supplied GetLexerCount() result controls a loop that writes to containers[30] without enforcing NB_MAX_EXTERNAL_LANG. A malicious or compromised plugin that reports more than 30 lexers can write beyond the stack array and corrupt control data, which can permit arbitrary code execution in the Notepad++ process context. This issue is fixed in version 8.9.8.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
Notepad++ is a widely used free and open-source source code editor for Microsoft Windows that supports numerous programming languages through its plugin architecture. The vulnerability described involves a critical stack buffer overflow located within the PluginsManager::loadPluginFromPath function in the PowerEditor component, specifically in the file PluginsManager.cpp. This flaw arises from an improper boundary check when processing external language plugins. Specifically, the application relies on the GetLexerCount() method provided by the plugin to determine how many lexers are available and subsequently iterates through them using a loop that writes data into a fixed-size stack array named containers[30]. The code fails to enforce the NB_MAX_EXTERNAL_LANG constant, which defines the maximum number of supported external languages. Consequently, if a malicious or compromised plugin reports more than thirty lexers via GetLexerCount(), the application will continue writing beyond the allocated bounds of the stack array.
This buffer overflow allows an attacker who can supply a specially crafted plugin to overwrite adjacent memory on the stack, including critical control data such as return addresses and saved frame pointers. By carefully crafting the payload within the excess lexer entries, it is possible to achieve arbitrary code execution within the context of the Notepad++ process. This represents a severe security risk because successful exploitation grants the attacker full control over the application's memory space, potentially leading to system compromise, data exfiltration, or further lateral movement depending on user privileges and installed software. The vulnerability aligns with CWE-121, which describes stack-based buffer overflow conditions where input validation is insufficient before writing to a fixed-size buffer.
From an operational perspective, the impact of this vulnerability extends beyond simple application crashes. Since Notepad++ is often used by developers who handle sensitive source code and configuration files, successful exploitation could lead to the theft of intellectual property or credentials stored within open documents. Furthermore, because plugins are third-party extensions that run with the same privileges as the host application, a compromised plugin acts as a trusted agent for an attacker. This scenario reflects aspects of the MITRE ATT&CK framework, particularly techniques related to execution via external binarys and potential privilege escalation if combined with other vulnerabilities or misconfigurations. The lack of strict input validation on data supplied by plugins highlights a common weakness in software that relies heavily on extensibility without rigorous sandboxing or boundary enforcement for plugin-provided metadata.
Mitigation strategies primarily involve updating the Notepad++ installation to version 8.9.8 or later, where this issue has been resolved through proper bounds checking and adherence to the NB_MAX_EXTERNAL_LANG limit during lexer loading operations. In environments where immediate patching is not feasible, administrators should restrict the ability of users to install third-party plugins by disabling plugin management features or enforcing strict whitelisting policies for allowed extensions. Additionally, deploying application control solutions that prevent unsigned or unapproved executables from running can provide an additional layer of defense against malicious plugins designed to exploit this vulnerability. Regular security audits and code reviews focusing on input validation in extension points are recommended to prevent similar stack-based buffer overflows in future updates.