Stack Buffer Overflow in Notepad++ Prior to 8.9.8

Executive Summary

This vulnerability is a stack-based buffer overflow in Notepad++ versions before 8.9.8. It occurs in the PluginsManager::loadPluginFromPath function where a plugin-supplied GetLexerCount() result controls a loop that writes to a fixed-size stack array without enforcing a maximum limit. A malicious plugin reporting more than 30 lexers can corrupt memory and execute arbitrary code in Notepad++.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Notepad++ version is below 8.9.8. Run 'notepad++ --version' or check Help > About Notepad++. If the version is older, the system is vulnerable. Additionally, monitor for crashes during Notepad++ startup, which may indicate a malicious plugin triggering the buffer overflow.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability allows arbitrary code execution within the Notepad++ process. This could lead to privilege escalation if Notepad++ runs with elevated permissions, persistence as the malicious plugin loads automatically on startup, and no further user interaction beyond initial plugin installation.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Notepad++ to version 8.9.8 or later. Download the update from the official Notepad++ website or GitHub releases. Remove any untrusted or third-party plugins from the plugins directory. Ensure Notepad++ is not running with elevated privileges to reduce potential impact.

Useful 0 Not Useful 0