Stack-Based Buffer Overflow in Notepad++ Affects Users Dragging Directories

CVE-2026-5525

What is CVE-2026-5525?

A stack-based buffer overflow vulnerability has been detected in Notepad++ version 8.9.3, which occurs during the processing of dragged and dropped directory paths. When a directory path exactly 259 characters long is dropped, the application improperly appends a trailing backslash along with a null terminator without adequate bounds checking. This flaw can lead to a stack buffer overflow, causing the application to crash and potentially exposing user data to security risks.

References