Notepad++ up to 8.9.7 Session Backup Parameters.cpp writeSession settingsDir stack-based overflow

Summaryinfo

A vulnerability classified as problematic has been found in Notepad++ up to 8.9.7. Affected is the function NppParameters::writeSession of the file PowerEditor/src/Parameters.cpp of the component Session Backup Handler. Performing a manipulation of the argument settingsDir results in stack-based overflow. This vulnerability is identified as CVE-2026-86054. The attack is only possible with local access. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Notepad++ up to 8.9.7. It has been classified as problematic. This affects the function NppParameters::writeSession of the file PowerEditor/src/Parameters.cpp of the component Session Backup Handler. The manipulation of the argument settingsDir with an unknown input leads to a stack-based overflow vulnerability. CWE is classifying the issue as CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). This is going to have an impact on availability. The summary by CVE is:

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in NppParameters::writeSession in PowerEditor/src/Parameters.cpp because it copies a session path derived from -settingsDir= into backupPathName[MAX_PATH] with unbounded wcscpy and appends SESSION_BACKUP_EXT with unbounded wcscat. A sufficiently long settings directory causes the backup suffix to exceed the fixed stack buffer when Notepad++ saves the session, and the protected release build terminates through its stack canary, causing denial of service. This issue is fixed in version 8.9.8.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-86054 since 09/04/2026. The exploitability is told to be easy. An attack has to be approached locally. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

Upgrading to version 8.9.8 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Document Reader Software

Name

• Notepad++

Version

• 8.9.0
• 8.9.1
• 8.9.2
• 8.9.3
• 8.9.4
• 8.9.5
• 8.9.6
• 8.9.7

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion