CVE-2026-85279: Notepad++ Stack Buffer Overflow RCE Vulnerability

CVE-2026-85279 Overview

CVE-2026-85279 is a stack buffer overflow vulnerability in Notepad++, a free and open-source source code editor. The flaw resides in PluginsManager::loadPluginFromPath within PowerEditor/src/MISC/PluginsManager/PluginsManager.cpp. A plugin-supplied GetLexerCount() return value controls a loop that writes into a fixed-size containers[30] stack array without enforcing the NB_MAX_EXTERNAL_LANG limit. A malicious or compromised plugin that reports more than 30 lexers can write beyond the stack array, corrupt control data, and achieve arbitrary code execution in the Notepad++ process context. The issue is fixed in version 8.9.8 and classified as [CWE-121] Stack-based Buffer Overflow.

Critical Impact
A malicious Notepad++ plugin can trigger a stack buffer overflow leading to arbitrary code execution in the user's process context.

Affected Products

Notepad++ versions prior to 8.9.8
PluginsManager component in PowerEditor/src/MISC/PluginsManager/PluginsManager.cpp
Any Notepad++ installation loading third-party plugins that expose GetLexerCount()

Discovery Timeline

2026-09-22 - CVE-2026-85279 published to NVD
2026-09-23 - Last updated in NVD database
v8.9.8 - Notepad++ releases patched version addressing the overflow

Technical Details for CVE-2026-85279

Vulnerability Analysis

The vulnerability sits in the plugin loading path of Notepad++. When Notepad++ loads a plugin, it calls the plugin-exported GetLexerCount() function to determine how many external lexers the plugin provides. The returned integer is used directly as the loop bound for populating a fixed-size stack array declared as std::unique_ptr<ExternalLangContainer> containers[30]{}.

Because the loop does not enforce the NB_MAX_EXTERNAL_LANG constant against the plugin-supplied count, a plugin returning a value greater than 30 causes writes past the end of the stack allocation. The overflow corrupts adjacent stack data, including saved return addresses and control structures, enabling arbitrary code execution in the Notepad++ process.

Root Cause

The root cause is a missing bounds check between an attacker-influenced count and a fixed-size container. A prior patch attempt introduced a shadowing variable declaration (int numLexers = numLexers > NB_MAX_EXTERNAL_LANG ...) that both failed to compile correctly and did not effectively clamp the loop bound. The containers array size was also hard-coded to 30 rather than referencing the NB_MAX_EXTERNAL_LANG macro, decoupling the buffer size from the intended limit.

Attack Vector

Exploitation requires a user to load a malicious or compromised plugin into Notepad++. The attack vector is local and requires user interaction, but no privileges beyond the standard user running the editor. Supply-chain compromise of a legitimate plugin, sideloaded plugin binaries, or social engineering delivery of a crafted DLL into the Notepad++ plugins directory are realistic delivery paths.

cpp

// Patch: enforce NB_MAX_EXTERNAL_LANG and align array size
			char lexName[MAX_EXTERNAL_LEXER_NAME_LEN]{};

			int numLexers = GetLexerCount();
-
-			std::unique_ptr<ExternalLangContainer> containers[30]{};
+			std::unique_ptr<ExternalLangContainer> containers[NB_MAX_EXTERNAL_LANG]{};
+			numLexers = numLexers > NB_MAX_EXTERNAL_LANG ? NB_MAX_EXTERNAL_LANG : numLexers;

			for (int x = 0; x < numLexers; ++x)
			{
// Source: https://github.com/notepad-plus-plus/notepad-plus-plus/commit/f1e1c71b090d69ca0f0175ab73895da41db67a16
// Follow-up compile fix: https://github.com/notepad-plus-plus/notepad-plus-plus/commit/70b88f95311d88523cde6be1b1ec938aa48c24bc

The patch replaces the hard-coded 30 with the NB_MAX_EXTERNAL_LANG macro and clamps numLexers before the write loop, closing the out-of-bounds write path.

Detection Methods for CVE-2026-85279

Indicators of Compromise

Unexpected DLL files present in the Notepad++ plugins directory that were not installed via Plugin Admin.
Notepad++ process (notepad++.exe) spawning child processes such as cmd.exe, powershell.exe, or rundll32.exe.
Crashes or Windows Error Reporting entries for notepad++.exe referencing stack corruption or access violations during startup.
Outbound network connections initiated by notepad++.exe to unfamiliar hosts shortly after launch.

Detection Strategies

Inventory installed Notepad++ versions across the fleet and flag any release below 8.9.8.
Hash and validate plugin DLLs in %PROGRAMFILES%\Notepad++\plugins\ and %APPDATA%\Notepad++\plugins\ against known-good sources.
Alert on process lineage where notepad++.exe is the parent of a shell or scripting interpreter.
Monitor plugin directories for file creation or modification events outside of Plugin Admin activity.

Monitoring Recommendations

Enable module load auditing for notepad++.exe to capture the full list of plugin DLLs loaded per session.
Ingest Sysmon Event IDs 1 (process create), 7 (image load), and 11 (file create) targeting the Notepad++ install and plugin paths.
Correlate Notepad++ crash telemetry with recent plugin installations to identify exploitation attempts.

How to Mitigate CVE-2026-85279

Immediate Actions Required

Upgrade Notepad++ to version 8.9.8 or later on all endpoints where the editor is installed.
Audit and remove untrusted or unknown plugin DLLs from user and system plugin directories.
Restrict plugin installation to the built-in Plugin Admin catalog and block sideloading via endpoint policy.
Communicate the risk to developer and power-user populations most likely to install third-party plugins.

Patch Information

The fix is available in Notepad++ Release v8.9.8. The vulnerability and remediation are documented in GitHub Security Advisory GHSA-h2wq-6x75-h8q2. The primary code change is in this commit with a follow-up compile fix in this commit. See the Notepad++ v8.9.8 Release News for the vendor announcement.

Workarounds

Remove all non-essential plugins until upgrading to 8.9.8 is complete.
Apply file system ACLs that prevent standard users from writing to the Notepad++ plugins directory.
Use application allowlisting to permit only vetted plugin DLL hashes to load into notepad++.exe.

bash

# Windows PowerShell: inventory Notepad++ plugin DLLs for review
Get-ChildItem -Path "$Env:ProgramFiles\Notepad++\plugins","$Env:APPDATA\Notepad++\plugins" -Recurse -Include *.dll -ErrorAction SilentlyContinue |
  Select-Object FullName, Length, LastWriteTime, @{Name='SHA256';Expression={(Get-FileHash $_.FullName -Algorithm SHA256).Hash}}