CVE-2026-86054
Received Received - Intake

Stack Buffer Overflow in Notepad++ Prior to 8.9.8

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in NppParameters::writeSession in PowerEditor/src/Parameters.cpp because it copies a session path derived from -settingsDir= into backupPathName[MAX_PATH] with unbounded wcscpy and appends SESSION_BACKUP_EXT with unbounded wcscat. A sufficiently long settings directory causes the backup suffix to exceed the fixed stack buffer when Notepad++ saves the session, and the protected release build terminates through its stack canary, causing denial of service. This issue is fixed in version 8.9.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-86054
EUVD
EUVD-2026-84572

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
notepad++ notepad++ 8.9.8
notepad++ notepad++ to 8.9.8 (inc)
notepad++ notepad++ to 8.9.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-86054 is a stack-based buffer overflow in Notepad++ versions 8.9.6.4 and earlier. It occurs in the NppParameters::writeSession function where a fixed-size stack buffer is used to store a session file path. The function copies the path using unbounded wcscpy and wcscat operations, then appends a fixed suffix. If the session path is too long (around 237-259+ characters), the buffer overflows, corrupting the stack and causing a crash due to the stack canary mechanism.

Detection Guidance

To detect this vulnerability, check if Notepad++ versions 8.9.6.4 or earlier are installed. Look for crashes with error code 0xC0000409 when closing Notepad++. Test by creating a folder with a 247-character path containing session.xml and launching Notepad++ with -settingsDir pointing to that folder.

Impact Analysis

This vulnerability allows an attacker to cause a denial of service by crashing Notepad++ when it attempts to save a session. The attack requires user interaction, such as launching Notepad++ with a specially crafted -settingsDir argument pointing to a long path. If the stack canary were bypassed, it could potentially lead to arbitrary code execution.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or other standards. However, denial of service attacks could disrupt operations, potentially impacting availability requirements. The vulnerability's impact on confidentiality and integrity is mitigated by the stack canary, which prevents arbitrary code execution in the default configuration.

Mitigation Strategies

Immediately upgrade Notepad++ to version 8.9.8 or later. Avoid using the -settingsDir command-line argument with untrusted paths. If using a portable installation, ensure the settings directory path is short and validated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86054. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart