Description

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the expandNppEnvironmentStrs function in PowerEditor/src/WinControls/StaticDialog/RunDlg/RunDlg.cpp copies a Notepad++ variable name between $( and ) into the fixed-size wchar_t str[MAX_PATH] stack buffer without bounding the m loop index, allowing a name of 260 or more characters to corrupt adjacent stack data, terminate the process through __report_gsfailure, and potentially execute code. This issue is fixed in version 8.9.7.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-17T20:16:44.323Z",
  "pubdate": "2026-08-17T20:16:44.323Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability exists in Notepad++ prior to version 8.9.7, specifically within the environment variable expansion functionality of the Run dialog. The vulnerability is triggered when processing specially crafted variable names enclosed between $( and ) markers that exceed the physical capacity of the destination buffer.\nThe flaw allows an attacker to cause memory corruption of adjacent stack data, leading to a denial of service via process termination through __report_gsfailure mechanisms, or potentially achieving arbitrary code execution within the context of the running application.\nThe affected product is Notepad++, impacting all versions prior to 8.9.7. Exploitation requires user interaction to process a maliciously crafted configuration, file, or command string containing an oversized variable name. The risk implications include complete application compromise and potential execution of malicious instructions if the stack corruption is successfully leveraged.",
  "technicalDetails": "The vulnerability resides in the expandNppEnvironmentStrs function located in PowerEditor/src/WinControls/StaticDialog/RunDlg/RunDlg.cpp. The root cause of the security defect is the lack of bounds checking on the loop index and copy operations when parsing variable names.\nSpecifically, the function extracts Notepad++ variable names delineated by $( and ) and copies them directly into a fixed-size wchar_t str[MAX_PATH] stack buffer. Because the implementation fails to bound the m loop index against the maximum capacity of the destination array, supplying a variable name consisting of 260 or more characters results in a classic stack-based buffer overflow.\nThe exploitation method relies on supplying an oversized variable name designed to overwrite critical stack control data, such as saved frame pointers and return addresses. When the memory corruption occurs, modern compiler-generated security mitigations such as stack cookies detect the tampering, immediately invoking __report_gsfailure to terminate the process and resulting in a denial of service.\nIn scenarios where the memory layout permits predictable overwrites or bypasses existing stack cookie protections, an attacker could potentially hijack the instruction pointer to execute arbitrary code payload behavior. The vulnerable component is the Run dialog environment variable expansion routine, affecting Notepad++ versions prior to 8.9.7.\nAuthentication and privilege requirements are minimal or non-existent beyond the capability to supply or influence the input string processed by the RunDlg component. Network exposure is typically local, although the vector could be triggered via malicious configuration files, workspace files, or external command execution vectors that invoke the vulnerable parsing logic."
}