Notepad CVE-2026-5525

The CVSS vector (AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) indicates local-only attack requiring low privileges, high complexity (specific path length trigger), and user interaction. The impact claims high confidentiality and integrity but no availability impact, contradicting the description's explicit mention of STATUS_STACK_BUFFER_OVERRUN crashes; this inconsistency suggests the CVSS may understate practical risk. Lack of KEV status and confirmed public exploit code reduces immediate real-world threat, but stack overflows on local systems can enable privilege escalation or code execution if exploited properly. The high complexity requirement (exact 259-character path without trailing backslash) acts as a natural exploit filter, reducing attack surface. This is a medium-priority issue: credible but not immediately critical, especially compared to remote or unauthenticated overflow vulnerabilities. Organizations with shared workstations or untrusted local users should prioritize patching.

A local user with limited privileges (e.g., guest account on a shared workstation) crafts a directory path of exactly 259 characters without a trailing backslash-for example, a deep nested folder structure on a shared drive-and drags it into an open Notepad++ window. The application's file drop handler appends a backslash and null terminator without bounds checking, writing 261+ bytes into a fixed-size stack buffer and triggering a STATUS_STACK_BUFFER_OVERRUN crash. While the current disclosure emphasizes application crash, such stack overflows on x86/x64 systems can be leveraged for code execution by carefully crafting the path to overwrite the return address; no public proof-of-concept demonstrating code execution has been identified at time of analysis.