CVE-2026-54758
Received Received - Intake

Stack-Based Buffer Overflow in Notepad++ Prior to 8.9.7

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the expandNppEnvironmentStrs function in PowerEditor/src/WinControls/StaticDialog/RunDlg/RunDlg.cpp copies a Notepad++ variable name between $( and ) into the fixed-size wchar_t str[MAX_PATH] stack buffer without bounding the m loop index, allowing a name of 260 or more characters to corrupt adjacent stack data, terminate the process through __report_gsfailure, and potentially execute code. This issue is fixed in version 8.9.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-18
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-54758
EUVD
EUVD-2026-60372

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
notepad++ notepad++ to 8.9.6.4 (inc)
notepad++ notepad++ 8.9.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stack-based buffer overflow in Notepad++ versions before 8.9.7. The vulnerability occurs in the expandNppEnvironmentStrs function where a fixed-size buffer of 260 characters is used to copy Notepad++ variable names without proper bounds checking. If a variable name exceeds 260 characters, it overflows the buffer, corrupting adjacent stack data and potentially crashing the application or allowing code execution.

Detection Guidance

To detect this vulnerability, check the installed version of Notepad++. Run Notepad++ and go to Help > About Notepad++. If the version is 8.9.6 or earlier, the system is vulnerable. Alternatively, use command line: notepad++ --version and compare against 8.9.7.

Impact Analysis

The immediate impact is a denial of service where Notepad++ crashes due to stack canary detection, leading to loss of unsaved work. If the stack canary is bypassed, the overflow could theoretically allow arbitrary code execution, though this is less likely in practice.

Compliance Impact

This vulnerability primarily causes denial of service by crashing Notepad++ through stack corruption, which could lead to loss of unsaved work. It does not directly impact compliance with GDPR or HIPAA as it is not a data breach or unauthorized access issue. However, if the vulnerability were exploited to execute arbitrary code, it could potentially lead to data exfiltration or unauthorized system access, indirectly affecting compliance.

Mitigation Strategies

Immediately update Notepad++ to version 8.9.7 or later. Download the latest version from the official Notepad++ website or use the built-in update feature. Avoid using the Run dialog with long environment variable names until updated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54758. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart