A stack-based buffer overflow vulnerability exists in Notepad++ version 8.9.3 in the file drop handler component. When a user drags and drops a directory path of exactly 259 characters without a trailing backslash, the application appends a backslash and null terminator without proper bounds checking, resulting in a stack buffer overflow and application crash (STATUS_STACK_BUFFER_OVERRUN).
References
| Link | Resource |
|---|---|
| https://github.com/notepad-plus-plus/notepad-plus-plus/commit/bfe7514d68bc559534c046c4ef2d1865267aa2b0 | Patch |
| https://github.com/notepad-plus-plus/notepad-plus-plus/issues/17921 | Issue Tracking Exploit Mitigation Vendor Advisory |
| https://github.com/notepad-plus-plus/notepad-plus-plus/pull/17930 | Issue Tracking Patch |
| https://github.com/notepad-plus-plus/notepad-plus-plus/issues/17921 | Issue Tracking Exploit Mitigation Vendor Advisory |
Configurations
History
05 Jun 2026, 13:54
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:notepad-plus-plus:notepad\+\+:8.9.3:*:*:*:*:*:*:* | |
| First Time |
Notepad-plus-plus
Notepad-plus-plus notepad\+\+ |
|
| References | () https://github.com/notepad-plus-plus/notepad-plus-plus/commit/bfe7514d68bc559534c046c4ef2d1865267aa2b0 - Patch | |
| References | () https://github.com/notepad-plus-plus/notepad-plus-plus/issues/17921 - Issue Tracking, Exploit, Mitigation, Vendor Advisory | |
| References | () https://github.com/notepad-plus-plus/notepad-plus-plus/pull/17930 - Issue Tracking, Patch |
10 Apr 2026, 13:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/notepad-plus-plus/notepad-plus-plus/issues/17921 - |
10 Apr 2026, 08:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-10 08:16
Updated : 2026-06-05 13:54
NVD link : CVE-2026-5525
Mitre link : CVE-2026-5525
CVE.ORG link : CVE-2026-5525
JSON object : View
Products Affected
notepad-plus-plus
- notepad\+\+
CWE
CWE-121
Stack-based Buffer Overflow