Executive brief
Notepad++ is a source code editor that supports plugins. Before version 8.9.8, a malicious or compromised plugin can trigger a stack buffer overflow by reporting more lexers than the application can handle, potentially allowing arbitrary code execution within Notepad++. This vulnerability requires the attacker to load or trick a user into loading a specially crafted plugin.
Technical details
A stack buffer overflow exists in PluginsManager::loadPluginFromPath when processing plugin-supplied GetLexerCount() results. The vulnerability occurs because the loop that writes to the containers[30] array is not bounded by NB_MAX_EXTERNAL_LANG, allowing a malicious plugin reporting more than 30 lexers to write beyond the stack array and corrupt control data. The fix implements bounds checking to cap numLexers to NB_MAX_EXTERNAL_LANG before the write loop.
Affected products
- Notepad++ Project Notepad++ before 8.9.8
Timeline
- 2026-09-22: disclosed