Executive brief
Notepad++ is a free source code editor used by millions of developers. A flaw in how it processes custom environment variable names allows an attacker to write excess data into memory, potentially crashing the application or executing malicious code on the developer's machine.
Technical details
The expandNppEnvironmentStrs function in RunDlg.cpp contains a stack buffer overflow vulnerability. When parsing Notepad++ environment variables delimited by $( and ), the code copies the variable name into a fixed 260-character (MAX_PATH) wchar_t buffer without validating the loop index, allowing variable names longer than 260 characters to overflow adjacent stack memory. This can trigger a stack corruption guard (__report_gsfailure), crash the process, or permit arbitrary code execution. The vulnerability exists in all versions prior to 8.9.7 and is fixed by adding proper bounds checking to the loop.
Affected products
- Notepad++ Team Notepad++ before 8.9.7
Timeline
- 2026-08-17: disclosed
- 2026-07-14: patched: Fixed in version 8.9.7