Notepad++ up to 8.9.7 PluginsManager PluginsManager.cpp loadPluginFromPath stack-based overflow

Summaryinfo

A vulnerability identified as problematic has been detected in Notepad++ up to 8.9.7. The affected element is the function PluginsManager::loadPluginFromPath of the file PowerEditor/src/MISC/PluginsManager/PluginsManager.cpp of the component PluginsManager. The manipulation leads to stack-based overflow. This vulnerability is uniquely identified as CVE-2026-85279. Local access is required to approach this attack. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Notepad++ up to 8.9.7. This issue affects the function PluginsManager::loadPluginFromPath of the file PowerEditor/src/MISC/PluginsManager/PluginsManager.cpp of the component PluginsManager. The manipulation with an unknown input leads to a stack-based overflow vulnerability. Using CWE to declare the problem leads to CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in PluginsManager::loadPluginFromPath in PowerEditor/src/MISC/PluginsManager/PluginsManager.cpp because the plugin-supplied GetLexerCount() result controls a loop that writes to containers[30] without enforcing NB_MAX_EXTERNAL_LANG. A malicious or compromised plugin that reports more than 30 lexers can write beyond the stack array and corrupt control data, which can permit arbitrary code execution in the Notepad++ process context. This issue is fixed in version 8.9.8.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-85279 since 09/03/2026. The exploitation is known to be easy. An attack has to be approached locally. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

Upgrading to version 8.9.8 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Document Reader Software

Name

• Notepad++

Version

• 8.9.0
• 8.9.1
• 8.9.2
• 8.9.3
• 8.9.4
• 8.9.5
• 8.9.6
• 8.9.7

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion