CVE-2026-85279: 
Notepad++ vulnerability analysis and mitigation

CVE-2026-85279 is a stack-based buffer overflow vulnerability in Notepad++ affecting all versions prior to 8.9.8. The flaw exists in PluginsManager::loadPluginFromPath (PowerEditor/src/MISC/PluginsManager/PluginsManager.cpp, lines 208–227), where a plugin-supplied GetLexerCount() return value controls a loop that writes to a fixed-size stack array containers[30] without enforcing the NB_MAX_EXTERNAL_LANG bound of 30. A malicious or compromised plugin returning more than 30 lexers can trigger an out-of-bounds stack write, potentially enabling arbitrary code execution. The vulnerability was disclosed via a GitHub Security Advisory (GHSA-h2wq-6x75-h8q2) published on August 24, 2026, and fixed in version 8.9.8 released August 23, 2026. It carries a CVSS v3.1 base score of 8.6 (High) (GitHub Advisory, v8.9.8 Release).

The root cause is CWE-121 (Stack-based Buffer Overflow): loadPluginFromPath() declares a fixed-size stack array std::unique_ptr<ExternalLangContainer> containers[30]{} but iterates the loop using the unchecked, plugin-supplied numLexers value from GetLexerCount(). When numLexers > 30, both branches of the inner if/else — containers[x] = std::make_unique<ExternalLangContainer>() and containers[x] = nullptr — write beyond the array's bounds, corrupting adjacent stack memory including saved registers and the return address. Critically, the existing ExternalLangHasRoom() guard (line 215) only protects a separate global array and does not prevent the local containers[x] out-of-bounds access in the else branch. Exploitation requires local filesystem write access to place a malicious DLL in the Notepad++ plugins directory and user interaction to launch Notepad++. A complete standalone C++ proof-of-concept (poc.cpp) demonstrating the overflow with AddressSanitizer output is included in the security advisory (GitHub Advisory).

Successful exploitation allows arbitrary code execution within the Notepad++ process context, running with the privileges of the user who launched the application. If Notepad++ is executed with elevated privileges (e.g., when editing system files as an administrator), the attacker inherits those elevated privileges, enabling full system compromise. Because the malicious plugin loads automatically on every Notepad++ startup, the attacker also gains persistent code execution. All three security dimensions are fully impacted: confidentiality (access to user data and credentials), integrity (ability to modify files and system state), and availability (process crash or controlled takeover) (GitHub Advisory).

A proof-of-concept exploit (poc.cpp) is publicly available in the GitHub Security Advisory, demonstrating the stack buffer overflow with both a raw segmentation fault and a detailed AddressSanitizer report. The EPSS score is approximately 0.212%, indicating a low but non-zero probability of exploitation in the wild. There is no confirmed evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The NVD SSVC assessment classifies exploitation status as "poc" with "total" technical impact (GitHub Advisory).

1. Create a malicious plugin DLL: Develop a Windows DLL that exports GetLexerCount() returning a value greater than 30 (e.g., 50). The DLL must conform to the Notepad++ plugin interface so it is loaded during startup.
2. Place the DLL in the plugins directory: Copy the malicious DLL to %PROGRAMFILES%\Notepad++\plugins\MalPlugin\MalPlugin.dll (standard install) or the equivalent plugins folder in a portable Notepad++ installation, where directory permissions may allow low-privilege write access.
3. Wait for or trigger Notepad++ startup: The overflow is triggered automatically when the user launches or restarts Notepad++, causing PluginsManager::loadPluginFromPath() to be invoked for each plugin in the directory.
4. Trigger the out-of-bounds write: loadPluginFromPath() calls the malicious GetLexerCount(), receives 50, and begins iterating the loop. At x = 30, writes to containers[30] (and beyond) corrupt adjacent stack memory — saved registers and the return address — in both the if and else branches.
5. Redirect execution: By controlling the loop count and data written via GetLexerName(), the attacker overwrites the saved return address with a pointer to attacker-supplied shellcode or a ROP gadget chain.
6. Achieve arbitrary code execution: When loadPluginFromPath() returns, execution flows to the attacker-controlled address, executing arbitrary code with the privileges of the Notepad++ process (GitHub Advisory).

• File System: Unexpected or unrecognized DLL files in %PROGRAMFILES%\Notepad++\plugins\ or portable install plugin directories; DLLs with unusual names, missing version metadata, or unsigned binaries in plugin subdirectories.
• Process: Unusual child processes spawned by notepad++.exe (e.g., cmd.exe, powershell.exe, curl.exe) shortly after application startup; Notepad++ process crashing with access violation or segmentation fault on startup.
• Logs: Windows Event Log entries (Application/System) showing Notepad++ crashes (Event ID 1000/1001) with faulting module path pointing to an unknown plugin DLL; crash dump files (*.dmp) in %LOCALAPPDATA%\CrashDumps referencing PluginsManager.
• Network: Unexpected outbound network connections from notepad++.exe to external IP addresses, particularly shortly after application launch, which may indicate a reverse shell or C2 beacon established via the injected payload (GitHub Advisory).

The primary remediation is to upgrade Notepad++ to version 8.9.8 or later, which clamps numLexers to NB_MAX_EXTERNAL_LANG before the loop executes, preventing any out-of-bounds write. The fix was implemented across two commits: f1e1c71 (initial fix) and 70b88f9 (compile error correction). As a workaround for environments that cannot immediately upgrade, administrators should restrict write access to the Notepad++ plugins directory, audit installed plugins for unrecognized or unsigned DLLs, and enforce plugin signature verification where available. Organizations deploying Notepad++ via shared network paths should ensure plugin directories are not writable by low-privileged accounts (v8.9.8 Release, Fix Commit).

The vulnerability was reported by researcher "cybertechajju" and disclosed by Notepad++ maintainer donho via the official GitHub Security Advisory program. The fix was released promptly in version 8.9.8, which received positive community reception on GitHub (52 reactions on the release). Brief coverage appeared on Mastodon via @thehackerwire. No major media coverage or significant vendor statements beyond the advisory itself have been identified at this time (GitHub Advisory, v8.9.8 Release).