Buffer Overflow Vulnerability in Notepad++ Affects PowerEditor Functionality

CVE-2026-54758

What is CVE-2026-54758?

A buffer overflow vulnerability exists in Notepad++ due to insufficient bounds checking when copying variable names in the expandNppEnvironmentStrs function. This flaw allows for the copying of variable names with lengths of 260 characters or more into a fixed-size stack buffer, potentially corrupting adjacent stack data. By exploiting this vulnerability, an attacker could terminate the process or execute arbitrary code. The issue has been addressed in version 8.9.7, which implements proper checks to prevent such vulnerabilities.

References