# CVE-2026-86054: Notepad++ stack buffer overflow in session path handling

Source: https://junglewise.ai/threats/cve-2026-86054-notepad-is-a-free-and-open-source-source-code-editor-prior-to-8-9  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-22. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86054 · Severity: high · CVSS 7.8 · Published 2026-09-22

Notepad++, a widely-used source code editor, contains a stack buffer overflow vulnerability in how it handles session file paths. An attacker can provide an overly long settings directory path via the -settingsDir command-line argument, causing the application to crash with a denial of service when it attempts to save the session. The protected build's stack canary prevents code execution, but the crash prevents legitimate use.

## Quick answers

**Is CVE-2026-86054 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86054 being exploited in the wild.

**How severe is CVE-2026-86054?** High severity, with a CVSS score of 7.8, published 22 September 2026.

**Which products and versions are affected?** Notepad++ Notepad++ before 8.9.8.

**Is there a fix for CVE-2026-86054?** A patch was published on 2026-08-23: version 8.9.8 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86054 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-86054?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in NppParameters::writeSession in PowerEditor/src/Parameters.cpp, where user-controlled session paths derived from the -settingsDir command-line parameter are copied into a fixed-size stack buffer (backupPathName[MAX_PATH]) using unbounded wcscpy and wcscat functions. A sufficiently long settings directory path causes the SESSION_BACKUP_EXT suffix to overflow the buffer, triggering a stack canary check in protected builds and terminating the process. The fix, applied in version 8.9.8, uses bounded string functions to prevent the overflow.

## Affected products

- Notepad++ Notepad++ before 8.9.8

## Timeline

- 2026-09-22: disclosed
- 2026-08-23: patched: version 8.9.8 released

## References

- [https://github.com/notepad-plus-plus/notepad-plus-plus/commit/046af3f626be7715886412313fc18f58b30dfcaf](https://github.com/notepad-plus-plus/notepad-plus-plus/commit/046af3f626be7715886412313fc18f58b30dfcaf)
- [https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.8](https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.8)