CVE-2026-54758: 
Notepad++ vulnerability analysis and mitigation

CVE-2026-54758 is a stack-based buffer overflow vulnerability in Notepad++ affecting all versions prior to 8.9.7 (including 8.9.6.4 and earlier). The flaw resides in the expandNppEnvironmentStrs function in PowerEditor/src/WinControls/StaticDialog/RunDlg/RunDlg.cpp, where a Notepad++ variable name is copied into a fixed-size wchar_t str[MAX_PATH] stack buffer without bounding the loop index. It was discovered by Leandro Batista (@IamLeandrooooo), published as a GitHub Security Advisory on July 14, 2026, and formally assigned a CVE on August 17, 2026. The NVD assigns a CVSS v3.1 base score of 7.8 (High), while the original advisory rates it 5.5 (Medium) based on a more conservative impact assessment (GitHub Advisory, Feedly).

The root cause is classified as CWE-121 (Stack-based Buffer Overflow) and CWE-787 (Out-of-bounds Write). In the vulnerable code, the m loop index is never checked against MAX_PATH (260), so a variable name of 260 or more characters between $( and ) in the Run dialog overwrites adjacent stack data. Under MSVC's /GS stack canary protection, this triggers __report_gsfailure and crashes the process; without /GS, arbitrary code execution is theoretically possible. The fix, applied in commit 0a9527e, adds a bounds check (m < MAX_PATH - 1) to the copy loop (GitHub Advisory, GitHub Commit).

The immediate, reliably reproducible impact is denial of service: the MSVC stack canary detects the corruption and terminates Notepad++ via __report_gsfailure, causing loss of any unsaved work. In a scenario where stack protection is absent or bypassed, the overflow could allow an attacker to achieve arbitrary code execution with the privileges of the running user. The attack is local and requires user interaction (the victim must open the Run dialog and execute a crafted command), limiting the blast radius to the affected workstation (GitHub Advisory).

A public proof-of-concept is included in the GitHub Security Advisory: an attacker sets a Windows environment variable to a string of 260+ characters and then crafts a Run dialog command referencing that variable via $(...) syntax to trigger the crash. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.194%, reflecting low probability of near-term exploitation (GitHub Advisory, Feedly).

1. Set up a malicious environment variable: On the target Windows system, open a CMD prompt and set an environment variable to a value of 260 or more characters, e.g., set NPP_POC_OVERFLOW=BBBBB...BBBBBcccccc (total length ≥ 260 characters).
2. Launch Notepad++ from the same CMD session: Start notepad++.exe from the CMD window so it inherits the crafted environment variable.
3. Open the Run dialog: In Notepad++, navigate to Run → Run... (or press F5) to open the Run dialog.
4. Inject the oversized variable reference: Enter a command that references the oversized variable using Notepad++'s $(...) syntax, e.g., cmd.exe $(AAAA...AAAA%NPP_POC_OVERFLOW%), where the variable name between $( and ) expands to 260+ characters.
5. Trigger the overflow: Click the Run button. The expandNppEnvironmentStrs function copies the variable name into the 260-slot stack buffer without bounds checking, overflowing it and corrupting the stack, causing Notepad++ to crash via __report_gsfailure (or potentially execute attacker-controlled code if stack protection is bypassed) (GitHub Advisory).

• Process: Unexpected termination of notepad++.exe with a Windows Error Reporting (WER) crash dialog referencing __report_gsfailure or a stack cookie violation.
• Logs: Windows Event Log entries (Application log) showing a crash of notepad++.exe with exception code 0xC0000409 (STATUS_STACK_BUFFER_OVERRUN) or similar stack corruption faults.
• Environment: Presence of unusually long Windows environment variables (260+ characters) set in the user or system environment, particularly those referenced in Notepad++ Run dialog history.
• File System: Windows Error Reporting dump files (.dmp) in %LOCALAPPDATA%\CrashDumps or %TEMP% associated with notepad++.exe crashes (GitHub Advisory).

Users should upgrade Notepad++ to version 8.9.7 or later, which includes the fix applied in commit 0a9527e (GitHub Release). No configuration-based workaround is available; the only mitigation is patching. As a temporary measure, users can avoid using the Run dialog (Run → Run...) with environment variable references until the update is applied (GitHub Advisory).

The vulnerability received moderate coverage from cybersecurity news outlets, with articles noting that Notepad++ 8.9.7 patched multiple flaws including this buffer overflow alongside PowerShell command injection issues (CyberSecurityNews, VPNCentral). Security community members on Mastodon and infosec.exchange discussed the release, and threat intelligence platforms such as Threadlinqs flagged it as part of their weekly digests. Coverage generally characterized the practical risk as limited due to the local, user-interaction-required attack vector.