CVE-2026-85279
Awaiting Analysis Awaiting Analysis - Queue

Stack Buffer Overflow in Notepad++ Prior to 8.9.8

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in PluginsManager::loadPluginFromPath in PowerEditor/src/MISC/PluginsManager/PluginsManager.cpp because the plugin-supplied GetLexerCount() result controls a loop that writes to containers[30] without enforcing NB_MAX_EXTERNAL_LANG. A malicious or compromised plugin that reports more than 30 lexers can write beyond the stack array and corrupt control data, which can permit arbitrary code execution in the Notepad++ process context. This issue is fixed in version 8.9.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-10-13
AI Q&A
2026-09-22
EPSS Evaluated
2026-10-11
NVD
CVE-2026-85279
EUVD
EUVD-2026-84570

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
notepad++ notepad++ to 8.9.6 (exc)
notepad++ notepad++ 8.9.8
notepad++ notepad++ to 8.9.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stack-based buffer overflow in Notepad++ versions before 8.9.8. It occurs in the PluginsManager::loadPluginFromPath function where a plugin-supplied GetLexerCount() result controls a loop that writes to a fixed-size stack array without enforcing a maximum limit. A malicious plugin reporting more than 30 lexers can corrupt memory and execute arbitrary code in Notepad++.

Detection Guidance

To detect this vulnerability, check if your Notepad++ version is below 8.9.8. Run 'notepad++ --version' or check Help > About Notepad++. If the version is older, the system is vulnerable. Additionally, monitor for crashes during Notepad++ startup, which may indicate a malicious plugin triggering the buffer overflow.

Impact Analysis

If exploited, this vulnerability allows arbitrary code execution within the Notepad++ process. This could lead to privilege escalation if Notepad++ runs with elevated permissions, persistence as the malicious plugin loads automatically on startup, and no further user interaction beyond initial plugin installation.

Compliance Impact

This vulnerability could potentially lead to arbitrary code execution in the Notepad++ process context, which may result in unauthorized access to sensitive data. If exploited, it could violate data protection requirements under GDPR or HIPAA by allowing unauthorized data access or modification.

Mitigation Strategies

Immediately update Notepad++ to version 8.9.8 or later. Download the update from the official Notepad++ website or GitHub releases. Remove any untrusted or third-party plugins from the plugins directory. Ensure Notepad++ is not running with elevated privileges to reduce potential impact.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85279. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart