Executive brief
Notepad++ is a popular open-source text and source code editor for Windows. A security vulnerability in version 8.9.3 allows an attacker to crash the application or potentially execute unauthorized code if a user is tricked into dragging and dropping a specially crafted folder onto the editor window. This could lead to a loss of unsaved work or a temporary disruption of the user's operations.
Technical details
A stack-based buffer overflow (CWE-121) exists in the file drop handler component of Notepad++ version 8.9.3. The vulnerability is located in 'PowerEditor/src/Notepad_plus.cpp' within the 'dropFiles' function. When a directory path of exactly 259 characters (MAX_PATH - 1) without a trailing backslash is dropped, the application attempts to append a backslash and a null terminator. Because the 'pathDropped' buffer is only 260 characters wide, appending the null terminator results in a 2-byte out-of-bounds write. This corrupts adjacent stack memory and triggers a stack-cookie violation (STATUS_STACK_BUFFER_OVERRUN), causing a denial-of-service. While the Windows /GS security cookie mitigates simple exploitation, memory corruption occurs before the check. A patch has been committed to the master branch to implement proper bounds checking.
Affected products
- Notepad++ Notepad++ 8.9.3
Timeline
- 2026-03-31: disclosed: Issue reported on GitHub by 00redbeer
- 2026-04-04: patched: Fix committed to master branch
- 2026-04-10: advisory: CVE-2026-5525 published