CVE-2026-86054: Notepad++ Stack Buffer Overflow DOS Vulnerability

CVE-2026-86054 Overview

Notepad++ contains a stack buffer overflow in NppParameters::writeSession within PowerEditor/src/Parameters.cpp. Versions prior to 8.9.8 copy a session path derived from the -settingsDir= command-line parameter into a fixed backupPathName[MAX_PATH] buffer using unbounded wcscpy, then append SESSION_BACKUP_EXT with unbounded wcscat. A sufficiently long settings directory overflows the fixed stack buffer when Notepad++ saves the session. The protected release build terminates through its stack canary, producing a denial of service. The issue is fixed in version 8.9.8.

Critical Impact
A user-supplied -settingsDir= value long enough to overflow a MAX_PATH stack buffer causes Notepad++ to crash via stack canary termination on session save.

Affected Products

Notepad++ versions prior to 8.9.8
PowerEditor/src/Parameters.cpp component (NppParameters::writeSession function)
Windows builds of Notepad++ that process the -settingsDir= command-line parameter

Discovery Timeline

2026-09-22 - CVE-2026-86054 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-86054

Vulnerability Analysis

The flaw is a classic stack-based buffer overflow classified under [CWE-121]. When Notepad++ saves the session, NppParameters::writeSession constructs a backup filename by copying the session path into a fixed-size stack buffer declared as wchar_t backupPathName[MAX_PATH]. The routine then appends the SESSION_BACKUP_EXT suffix. Both operations use the unbounded C runtime routines std::wcscpy and std::wcscat, neither of which enforces the destination buffer size. When the session path originates from a long -settingsDir= command-line argument, the concatenated result exceeds MAX_PATH wide characters and overwrites adjacent stack memory. Release builds ship with stack cookies, so the overflow is caught at function epilogue and the process is terminated, yielding a denial of service rather than arbitrary code execution.

Root Cause

The root cause is the combination of a fixed-size stack buffer (MAX_PATH wide characters) with unbounded string primitives that trust an attacker-controllable input. No length validation is performed against the -settingsDir= value before it is concatenated with the backup extension.

Attack Vector

Exploitation requires local access and user interaction. An attacker must convince a user to launch Notepad++ with a crafted -settingsDir= argument, for example through a shortcut file, script, or file-association hijack. Once the editor triggers a session save, the overflow occurs and the process aborts.

cpp

// Security patch in PowerEditor/src/Parameters.cpp
// Replaces fixed stack buffer + unbounded wcscpy/wcscat with std::wstring
//
// Backup session file before overwriting it
//
-	wchar_t backupPathName[MAX_PATH]{};
+	std::wstring backupPathName;
 	BOOL doesBackupCopyExist = FALSE;
 	if (doesFileExist(sessionPathName))
 	{
-		std::wcscpy(backupPathName, sessionPathName);
-		std::wcscat(backupPathName, SESSION_BACKUP_EXT);
+		backupPathName = sessionPathName;
+		backupPathName += SESSION_BACKUP_EXT;

		// Make sure backup file is not read-only, if it exists
-		removeReadOnlyFlagFromFileAttributes(backupPathName);
-		doesBackupCopyExist = CopyFile(sessionPathName, backupPathName, FALSE);
+		removeReadOnlyFlagFromFileAttributes(backupPathName.c_str());
+		doesBackupCopyExist = CopyFile(sessionPathName, backupPathName.c_str(), FALSE);

Source: GitHub commit 046af3f

Detection Methods for CVE-2026-86054

Indicators of Compromise

Unexpected termination of notepad++.exe accompanied by a Windows Error Reporting event referencing stack cookie or __report_gsfailure.
Notepad++ process command lines containing an unusually long -settingsDir= value, especially paths approaching or exceeding MAX_PATH (260) wide characters.
Shortcut files, scripts, or scheduled tasks that invoke Notepad++ with attacker-controlled -settingsDir= arguments.

Detection Strategies

Inspect process creation telemetry (Sysmon Event ID 1, Windows Event ID 4688) for notepad++.exe invocations and flag command lines where the -settingsDir= value length approaches or exceeds 260 characters.
Correlate application crash events (Event ID 1000) for notepad++.exe with recent process launches that included the -settingsDir= parameter.
Track deployed Notepad++ versions across the fleet and alert on installations older than 8.9.8.

Monitoring Recommendations

Enable command-line auditing and Sysmon process creation logging on Windows endpoints where Notepad++ is installed.
Forward application error and Windows Error Reporting events to the SIEM to catch repeated crashes indicative of exploitation attempts.
Monitor changes to file associations and .lnk shortcuts pointing to notepad++.exe for anomalous arguments.

How to Mitigate CVE-2026-86054

Immediate Actions Required

Upgrade all Notepad++ installations to version 8.9.8 or later using the official release from Notepad++ News Release v8.9.8.
Audit shortcuts, scripts, and scheduled tasks that launch notepad++.exe with a -settingsDir= argument and validate the path length.
Remove untrusted or attacker-supplied Notepad++ shortcuts from shared drives and user profiles.

Patch Information

The fix replaces the fixed wchar_t backupPathName[MAX_PATH] buffer with a dynamically sized std::wstring, eliminating the unbounded wcscpy and wcscat calls. Details are in the GitHub Security Advisory GHSA-pxgg-96p2-c3hx, the GitHub Release v8.9.8, and the source commit 046af3f.

Workarounds

Avoid launching Notepad++ with a -settingsDir= argument until the upgrade is complete.
Restrict modification of Notepad++ shortcuts and file associations to trusted administrators.
Apply application control policies to prevent execution of Notepad++ from unauthorized locations that could carry crafted arguments.

bash

# Verify the installed Notepad++ version on Windows (PowerShell)
(Get-Item "C:\Program Files\Notepad++\notepad++.exe").VersionInfo.FileVersion

# Inspect recent process launches for suspicious -settingsDir= arguments
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} |
  Where-Object { $_.Message -match 'notepad\+\+\.exe' -and $_.Message -match '-settingsDir=' } |
  Select-Object TimeCreated, Message