CVE-2026-86054: Notepad++: Stack Buffer Overflow in `NppParameters::writeSession` via overlong session path
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in NppParameters::writeSession in PowerEditor/src/Parameters.cpp because it copies a session path derived from -settingsDir= into backupPathName[MAXPATH] with unbounded wcscpy and appends SESSIONBACKUPEXT with unbounded wcscat. A sufficiently long settings directory causes the backup suffix to exceed the fixed stack buffer when Notepad++ saves the session, and the protected release build terminates through its stack canary, causing denial of service. This issue is fixed in version 8.9.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Notepad++to a version that resolves this vulnerability.Fixed in 8.9.8
Event History
Frequently Asked Questions
Who is exposed to this issue?
Notepad++ installations earlier than 8.9.8 are affected when they are launched with a sufficiently long directory supplied through the -settingsDir= option.
What does an attacker need to exploit it?
An attacker needs to cause Notepad++ to use an overlong -settingsDir= path and have the application save its session. The reported protected release behavior is stack-canary termination, resulting in denial of service.
Is there a fixed version?
Yes. The issue is fixed in Notepad++ version 8.9.8.
How can I determine whether an installation may be affected?
Check whether the installed Notepad++ version is earlier than 8.9.8 and whether it is launched with the -settingsDir= option using a sufficiently long path. The failure occurs when Notepad++ saves the session.