CVE-2026-54758: Notepad++ Buffer Overflow Vulnerability

CVE-2026-54758 Overview

CVE-2026-54758 is a stack-based buffer overflow [CWE-121] in Notepad++, a widely deployed open-source source code editor. The flaw resides in the expandNppEnvironmentStrs function in PowerEditor/src/WinControls/StaticDialog/RunDlg/RunDlg.cpp. The function copies a Notepad++ variable name enclosed between $( and ) into a fixed-size wchar_t str[MAX_PATH] stack buffer without bounding the loop index. A variable name of 260 or more characters overflows the buffer, corrupts adjacent stack data, triggers __report_gsfailure, and may allow local code execution. The issue is fixed in Notepad++ version 8.9.7.

Critical Impact
A crafted variable name of 260+ characters processed by the Run dialog corrupts stack memory, terminates the process, and can lead to arbitrary code execution in the user's context.

Affected Products

Notepad++ versions prior to 8.9.7
PowerEditor/src/WinControls/StaticDialog/RunDlg/RunDlg.cpp component
Windows builds of Notepad++ processing Notepad++ environment variable strings

Discovery Timeline

2026-08-17 - CVE-2026-54758 published to NVD
2026-08-17 - Last updated in NVD database
v8.9.7 release - Notepad++ project publishes fixed version (see GitHub Release v8.9.7)

Technical Details for CVE-2026-54758

Vulnerability Analysis

The defect is a classic stack buffer overflow in Notepad++'s environment string expansion routine. expandNppEnvironmentStrs walks the input string searching for tokens delimited by $( and ). When it finds such a token, it copies the characters between the delimiters into a local buffer wchar_t str[MAX_PATH], where MAX_PATH is 260 on Windows. The copy loop increments an index m without validating it against the destination buffer size.

An attacker who supplies a variable name of 260 or more wide characters writes past the end of the stack buffer. The overflow corrupts saved registers, the stack canary, and the return address region. Visual C++ stack protection detects the corrupted cookie and calls __report_gsfailure, terminating the process. Where stack protection can be bypassed or the corruption is shaped precisely, an attacker may achieve arbitrary code execution in the context of the Notepad++ process.

Root Cause

The root cause is missing bounds checking on the write index in the token copy loop. The removed source comment // Since I'm sure the length will be 256, I won't check the lstrlen : watch out! documents an explicit developer decision to skip length validation, which contradicts safe fixed-size buffer handling.

Attack Vector

Exploitation requires local access and user interaction: a target must open or execute a document, configuration, or Run dialog input containing a crafted $(<260+ chars>) token. Delivery vectors include malicious project files, session files, or shared configuration that Notepad++ parses through the Run dialog code path.

cpp

// Patch context from Notepad++ commit 0a9527e9f7140a2323e25d14e362b46ee0efc3db
// File: PowerEditor/src/WinControls/StaticDialog/RunDlg/RunDlg.cpp

 	return VAR_NOT_RECOGNIZED;
 }
 
-// Since I'm sure the length will be 256, I won't check the lstrlen : watch out!
 void expandNppEnvironmentStrs(const wchar_t *strSrc, wchar_t *stringDest, size_t strDestLen, HWND hWnd)
 {
 	size_t j = 0;

Source: GitHub Commit 0a9527e. The patch removes the unsafe assumption comment and introduces bounds enforcement so the copy cannot exceed the destination buffer.

Detection Methods for CVE-2026-54758

Indicators of Compromise

Unexpected Notepad++ process crashes with Windows Error Reporting entries referencing __report_gsfailure or fast-fail exception code 0xC0000409.
Notepad++ session, workspace, or project files containing $( sequences followed by 260 or more characters before a closing ).
Newly written child processes or DLLs launched from notepad++.exe shortly before a crash event.

Detection Strategies

Statically scan documents, session files, and shortcut arguments handled by Notepad++ for oversized $(...) tokens.
Alert on Notepad++ process termination events accompanied by stack cookie failure telemetry from Windows Error Reporting.
Inventory endpoints running Notepad++ versions below 8.9.7 using software asset management data.

Monitoring Recommendations

Forward notepad++.exe crash telemetry and application error events to your SIEM for correlation.
Monitor for anomalous child process creation from notepad++.exe, which is uncommon on typical user endpoints.
Track file writes and executions originating from notepad++.exe in EDR telemetry to catch post-exploitation behavior.

How to Mitigate CVE-2026-54758

Immediate Actions Required

Upgrade all Notepad++ installations to version 8.9.7 or later using the official GitHub Release v8.9.7.
Identify vulnerable installs across the estate and prioritize systems where users open untrusted files.
Review the GitHub Security Advisory GHSA-gv94-327x-2gc5 for vendor guidance.

Patch Information

The fix is committed in commit 0a9527e and shipped in Notepad++ 8.9.7. The patch adds explicit bounds handling in expandNppEnvironmentStrs so variable-name tokens cannot overflow the wchar_t str[MAX_PATH] stack buffer.

Workarounds

Avoid opening untrusted Notepad++ session, workspace, or project files until the upgrade is applied.
Do not paste or execute Run dialog commands containing unverified $(...) variable expansions.
Restrict Notepad++ execution on high-risk endpoints via application control policies until patched builds are deployed.

bash

# Verify installed Notepad++ version on Windows endpoints (PowerShell)
Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',\
                       'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' |
  Where-Object { $_.DisplayName -like 'Notepad++*' } |
  Select-Object DisplayName, DisplayVersion, InstallLocation