CVE-2026-85279: Notepad++: Stack Buffer Overflow in Plugin Lexer Loading via Unchecked GetLexerCount() Return Value
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in PluginsManager::loadPluginFromPath in PowerEditor/src/MISC/PluginsManager/PluginsManager.cpp because the plugin-supplied GetLexerCount() result controls a loop that writes to containers[30] without enforcing NBMAXEXTERNALLANG. A malicious or compromised plugin that reports more than 30 lexers can write beyond the stack array and corrupt control data, which can permit arbitrary code execution in the Notepad++ process context. This issue is fixed in version 8.9.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Notepad++to a version that resolves this vulnerability.Fixed in 8.9.8
Event History
Frequently Asked Questions
Who is exposed to this issue?
Notepad++ installations prior to version 8.9.8 are exposed when they load a malicious or compromised plugin. The resulting code execution occurs in the Notepad++ process context.
What does exploitation require?
An attacker needs a plugin to be loaded by Notepad++ that supplies a GetLexerCount() value greater than 30. The vulnerability is triggered during plugin lexer loading; the provided data does not establish that a default installation is affected without such a plugin.
What should be done if patching cannot be performed immediately?
Avoid loading untrusted plugins and remove or disable plugins suspected of being malicious or compromised. This reduces exposure because the vulnerable path depends on a plugin-controlled lexer count.
How can I determine whether an installation is affected?
Check the installed Notepad++ version. Versions prior to 8.9.8 are affected; version 8.9.8 contains the fix.