Quick answers
- Is CVE-2026-54758 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-54758 being exploited in the wild.
- How severe is CVE-2026-54758?
- High severity, with a CVSS score of 7.8, published 17 August 2026.
- Which products and versions are affected?
- Notepad++ Team Notepad++ before 8.9.7.
- Is there a fix for CVE-2026-54758?
- A patch was published on 2026-07-14: Fixed in version 8.9.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-54758 attacked?
- It is attacked with local access.
- Am I affected by CVE-2026-54758?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The expandNppEnvironmentStrs function in RunDlg.cpp contains a stack buffer overflow vulnerability. When parsing Notepad++ environment variables delimited by $( and ), the code copies the variable name into a fixed 260-character (MAX_PATH) wchar_t buffer without validating the loop index, allowing variable names longer than 260 characters to overflow adjacent stack memory. This can trigger a stack corruption guard (__report_gsfailure), crash the process, or permit arbitrary code execution. The vulnerability exists in all versions prior to 8.9.7 and is fixed by adding proper bounds checking to the loop.
Affected products
- Notepad++ Team Notepad++ before 8.9.7
Timeline
- 2026-08-17: disclosed
- 2026-07-14: patched: Fixed in version 8.9.7