CVE-2026-86054: 
Notepad++ vulnerability analysis and mitigation

CVE-2026-86054 is a stack-based buffer overflow vulnerability in Notepad++ affecting all versions prior to 8.9.8. The flaw exists in NppParameters::writeSession in PowerEditor/src/Parameters.cpp, where a session path derived from the -settingsDir= command-line argument is copied into a fixed 260-wide-character stack buffer using unbounded wcscpy and wcscat calls. When a sufficiently long settings directory path is provided, appending the .inCaseOfCorruption.bak suffix overflows the buffer, triggering the stack canary and causing a denial of service. The vulnerability was disclosed on August 24, 2026, and fixed in version 8.9.8 released the same day. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-121 (Stack-based Buffer Overflow). In NppParameters::writeSession, the code declares wchar_t backupPathName[MAX_PATH]{} (260 wide characters), then calls std::wcscpy(backupPathName, sessionPathName) followed by std::wcscat(backupPathName, SESSION_BACKUP_EXT), where SESSION_BACKUP_EXT is .inCaseOfCorruption.bak (22 characters). The _userPath variable is set directly from the -settingsDir= command-line argument with no length validation, and _sessionPath is constructed as _userPath + "session.xml". A path of approximately 247 characters causes sessionPathName to reach ~259 characters, and the subsequent wcscat overflows the buffer by ~21 characters. This is noted as the same wcscpy/wcscat-into-MAX_PATH anti-pattern as CVE-2026-54758, but in a different function that was not addressed by the earlier fix. The fix replaces the fixed-size stack buffer with a std::wstring, eliminating the overflow entirely (GitHub Advisory, Fix Commit).

The primary impact is denial of service: the /GS stack canary detects the overflow and invokes __report_gsfailure, terminating Notepad++ with exit code 0xC0000409 (STATUS_STACK_BUFFER_OVERRUN). The advisory notes that potential code execution could be possible if the /GS stack protection were absent, and the CVSS score reflects High confidentiality, integrity, and availability impacts to account for this theoretical risk. The attack is local in scope and requires user interaction (launching Notepad++ with a crafted argument), limiting its blast radius to the affected user's session with no lateral movement potential (GitHub Advisory, Feedly).

A proof-of-concept (PoC) exploit with step-by-step reproduction instructions is publicly available in the GitHub Security Advisory. The EPSS score is approximately 0.002 (0.2%), indicating low probability of widespread exploitation. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The exploit is not automatable (requires user interaction) and is classified as a standalone denial-of-service with no chaining potential (GitHub Advisory, Feedly). The vulnerability was credited to Hung Bach Ngoc and Thai Son Dinh from VinSOC Labs.

1. Prepare the long-path directory: Create a nested directory structure under %TEMP% such that the full folder path is approximately 247 characters long (e.g., C:\Users\<user>\AppData\Local\Temp\AAAA...AAA\), ensuring that appending session.xml yields a path of approximately 259 characters.
2. Create a session.xml file: Place any file named session.xml inside the crafted long-path directory. The content can be arbitrary or empty.
3. Launch Notepad++ with the crafted -settingsDir argument: Execute the following command, substituting <the ~247-char folder> with the prepared path:

   notepad++.exe -multiInst -settingsDir="<the ~247-char folder>" C:\Windows\win.ini

   This sets _cmdSettingsDir to the long path, which propagates to _userPath and then _sessionPath = _userPath + "session.xml".
4. Close Notepad++: Upon closing, Notepad++ calls NppParameters::writeSession, which executes wcscpy(backupPathName, sessionPathName) (copying ~259 chars into a 260-char buffer), then wcscat(backupPathName, SESSION_BACKUP_EXT) (appending 22 chars), overflowing the stack buffer by ~21 characters.
5. Observe crash: The /GS stack canary detects the overflow and terminates Notepad++ with exit code 0xC0000409 (STATUS_STACK_BUFFER_OVERRUN), confirming successful exploitation (GitHub Advisory).

• Process: Notepad++ (notepad++.exe) terminating unexpectedly with exit code 0xC0000409 (STATUS_STACK_BUFFER_OVERRUN) upon closing.
• Logs: Windows Event Log entries (Application log) recording a crash of notepad++.exe with exception code 0xC0000409; Dr. Watson or Windows Error Reporting entries referencing NppParameters::writeSession or Parameters.cpp.
• File System: Presence of a session.xml file inside an unusually long directory path (≥247 characters) under %TEMP% or another writable location; absence of the expected .inCaseOfCorruption.bak backup file due to the crash occurring before it is written.
• Command Line: Process creation logs (e.g., Sysmon Event ID 1) showing notepad++.exe launched with a -settingsDir= argument pointing to an abnormally long path (GitHub Advisory).

The primary remediation is to upgrade Notepad++ to version 8.9.8 or later, which replaces the fixed-size wchar_t backupPathName[MAX_PATH] stack buffer with a std::wstring, eliminating the overflow entirely (Fix Commit, v8.9.8 Release). As a workaround for environments that cannot immediately upgrade, administrators should restrict the ability to launch Notepad++ with arbitrary command-line arguments, or enforce policies that limit the length of paths passed via -settingsDir=. Users relying on portable or cloud-settings configurations with long paths should also validate that their settings directory path does not approach 237 characters (GitHub Advisory).

The vulnerability was discovered and reported by Hung Bach Ngoc and Thai Son Dinh from VinSOC Labs (Redteam and R&D teams), and the advisory was published by Notepad++ maintainer donho on August 24, 2026. The advisory notes this is the same wcscpy/wcscat-into-MAX_PATH anti-pattern as CVE-2026-54758, highlighting a recurring class of vulnerability in the codebase. No significant broader media coverage or notable community controversy has been identified beyond the GitHub advisory and standard vulnerability database entries (GitHub Advisory).