CVE-2026-86054 in Notepad++
Summary
by MITRE • 09/22/2026
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in NppParameters::writeSession in PowerEditor/src/Parameters.cpp because it copies a session path derived from -settingsDir= into backupPathName[MAX_PATH] with unbounded wcscpy and appends SESSION_BACKUP_EXT with unbounded wcscat. A sufficiently long settings directory causes the backup suffix to exceed the fixed stack buffer when Notepad++ saves the session, and the protected release build terminates through its stack canary, causing denial of service. This issue is fixed in version 8.9.8.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/22/2026
Notepad++ is a widely utilized free and open-source source code editor that supports multiple programming languages and offers features such as syntax highlighting, macro recording, and plugin support. The vulnerability identified affects versions prior to 8.9.8 and resides within the core parameter handling logic of the application. Specifically, the flaw occurs in the NppParameters::writeSession function located in the PowerEditor/src/Parameters.cpp source file. This component is responsible for managing user session data, including saving current editing states and configurations to disk. The security issue stems from improper boundary checking when constructing a backup path name during this save operation.
The technical root cause of the vulnerability is a stack buffer overflow resulting from unbounded string copy operations. When Notepad++ initiates a session save, it derives a file path for the backup file based on the settings directory specified by the user via the -settingsDir command-line argument or configuration setting. The application attempts to write this path into a fixed-size stack buffer named backupPathName, which is defined with a maximum length of MAX_PATH characters. However, the code utilizes unbounded functions wcscpy and wcscat for string manipulation. First, it copies the session path derived from the settings directory into the buffer using wcscpy without verifying if the source string fits within the allocated space. Subsequently, it appends the SESSION_BACKUP_EXT suffix to this path using wcscat, another unbounded function that does not check remaining buffer capacity. If a user specifies a sufficiently long settings directory path, the combined length of the base path and the appended extension exceeds the MAX_PATH limit defined for backupPathName.
This overflow leads directly to memory corruption on the stack. In protected release builds of Notepad++, which include security mitigations such as stack canaries, this buffer overrun triggers an immediate termination of the application process upon detection by the runtime environment. The primary operational impact is a denial of service condition where the editor crashes unexpectedly when attempting to save or restore sessions under specific path configurations. While modern build protections prevent arbitrary code execution in most standard scenarios, the crash itself disrupts user workflow and can lead to data loss if unsaved work is not preserved through other means. Although stack canaries mitigate exploitation for remote code execution, the vulnerability remains a significant stability issue and represents a potential attack vector if deployed on systems with disabled security mitigations or older compiler versions lacking such protections.
From a classification perspective, this flaw aligns with CWE-120 Buffer Copy without Checking Size of Input Classic buffer overflow and specifically involves stack-based memory corruption which may relate to CWE-787 Out-of-bounds Write depending on the exact offset and overwrite target. In terms of adversary tactics, while primarily causing denial of service in protected builds, such vulnerabilities can be leveraged for local privilege escalation or application instability attacks if exploited in environments with weaker security controls, mapping loosely to ATT&CK techniques related to resource hijacking or impact via disruption.
The vulnerability has been remediated in Notepad++ version 8.9.8 and later releases. The fix involves replacing the unbounded string functions wcscpy and wcscat with bounded alternatives such as wcsncpy and wcscat_s, ensuring that buffer limits are strictly enforced during path construction. Users should upgrade to version 8.9.8 or newer immediately to mitigate this risk. Additionally, administrators deploying Notepad++ in enterprise environments should enforce the use of validated input for command-line arguments like -settingsDir to prevent excessively long paths from being passed to the application at runtime. Regular patch management and adherence to secure coding practices that prioritize bounded string operations are essential defenses against such memory corruption vulnerabilities.