# CVE-2026-5525: Notepad++ stack buffer overflow in file drop handler

Source: https://junglewise.ai/threats/cve-2026-5525-notepad-stack-buffer-overflow-in-file-drop-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-10. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2026-5525 · Severity: medium · CVSS 6 · Published 2026-04-10

Notepad++ is a popular open-source text and source code editor for Windows. A security vulnerability in version 8.9.3 allows an attacker to crash the application or potentially execute unauthorized code if a user is tricked into dragging and dropping a specially crafted folder onto the editor window. This could lead to a loss of unsaved work or a temporary disruption of the user's operations.

Technologies: [Notepad++ Notepad\+\+](https://junglewise.ai/threats/technologies/notepad). Vendors: [Notepad++](https://junglewise.ai/threats/vendors/notepad-plus-plus).

## Quick answers

**Is CVE-2026-5525 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5525 being exploited in the wild.

**How severe is CVE-2026-5525?** Medium severity, with a CVSS score of 6, published 10 April 2026.

**Which products and versions are affected?** Notepad++ Notepad++ 8.9.3.

**Is there a fix for CVE-2026-5525?** A patch was published on 2026-04-04: Fix committed to master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-5525 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-5525?** Check whether you run Notepad++ Notepad\+\+. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow (CWE-121) exists in the file drop handler component of Notepad++ version 8.9.3. The vulnerability is located in 'PowerEditor/src/Notepad_plus.cpp' within the 'dropFiles' function. When a directory path of exactly 259 characters (MAX_PATH - 1) without a trailing backslash is dropped, the application attempts to append a backslash and a null terminator. Because the 'pathDropped' buffer is only 260 characters wide, appending the null terminator results in a 2-byte out-of-bounds write. This corrupts adjacent stack memory and triggers a stack-cookie violation (STATUS_STACK_BUFFER_OVERRUN), causing a denial-of-service. While the Windows /GS security cookie mitigates simple exploitation, memory corruption occurs before the check. A patch has been committed to the master branch to implement proper bounds checking.

## Affected products

- Notepad++ Notepad++ 8.9.3

## Timeline

- 2026-03-31: disclosed: Issue reported on GitHub by 00redbeer
- 2026-04-04: patched: Fix committed to master branch
- 2026-04-10: advisory: CVE-2026-5525 published

## References

- [https://github.com/notepad-plus-plus/notepad-plus-plus/commit/bfe7514d68bc559534c046c4ef2d1865267aa2b0](https://github.com/notepad-plus-plus/notepad-plus-plus/commit/bfe7514d68bc559534c046c4ef2d1865267aa2b0)
- [https://github.com/notepad-plus-plus/notepad-plus-plus/issues/17921](https://github.com/notepad-plus-plus/notepad-plus-plus/issues/17921)
- [https://github.com/notepad-plus-plus/notepad-plus-plus/pull/17930](https://github.com/notepad-plus-plus/notepad-plus-plus/pull/17930)

## Related threats

- [Notepad++ 8.9.3 contains a format string injection vulnerability in the Find Results panel handler that allows…](https://junglewise.ai/threats/cve-2026-6539-notepad-8-9-3-contains-a-format-string-injection-vulnerability-in)