Stack Buffer Overflow in Notepad++ Source Code Editor
CVE-2026-86054

7.8HIGH

Key Information:

Vendor

Notepad-plus-plus

Status
Notepad-plus-plus
Vendor
CVE Published:
22 September 2026

What is CVE-2026-86054?

A stack buffer overflow vulnerability exists in Notepad++ prior to version 8.9.8 within the NppParameters::writeSession function. This occurs due to improper handling of session paths derived from the -settingsDir argument, leading to an overflowing backupPathName buffer when saving session data. If the settings directory length exceeds expected limits, it can cause the application to terminate unexpectedly, resulting in a denial of service. This issue has been addressed in version 8.9.8.

Affected Version(s)

notepad-plus-plus < 8.9.8

References

https://github.com/notepad-plus-plus/notepad-plus-plus/se...
x_refsource_CONFIRM
https://github.com/notepad-plus-plus/notepad-plus-plus/co...
x_refsource_MISC
https://github.com/notepad-plus-plus/notepad-plus-plus/re...
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.