EUVD-2026-84572Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local -settingsDir argument control with user interaction to trigger a session save; canary-terminated release build yields only an application crash, so C:N/I:N/A:L.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in NppParameters::writeSession in PowerEditor/src/Parameters.cpp because it copies a session path derived from -settingsDir= into backupPathName[MAX_PATH] with unbounded wcscpy and appends SESSION_BACKUP_EXT with unbounded wcscat. A sufficiently long settings directory causes the backup suffix to exceed the fixed stack buffer when Notepad++ saves the session, and the protected release build terminates through its stack canary, causing denial of service. This issue is fixed in version 8.9.8.
Articles & Coverage 1
AnalysisAI
Notepad++ installations prior to 8.9.8 crash when a local attacker can control the -settingsDir= command-line argument and points it at an abnormally long directory path. When Notepad++ subsequently saves its session, NppParameters::writeSession copies the derived session path into a fixed MAX_PATH stack buffer with unbounded wcscpy/wcscat calls and appends the session-backup suffix, overflowing the buffer; on protected release builds the stack canary halts the process, producing a denial of service rather than exploitable code execution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local control of the Notepad++ -settingsDir= command-line argument set to a path long enough that appending SESSION_BACKUP_EXT exceeds the MAX_PATH stack buffer, plus user interaction: the victim must launch Notepad++ with that argument and reach a session-save operation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) claims full confidentiality, integrity and availability impact, but this OVERSTATES the real-world effect: the description explicitly states that the protected release build terminates through its stack canary, producing only a denial of service (the Notepad++ process crashes). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Notepad++ 8.9.8 or later (vendor-released patch), which is the release that contains the fix commit 046af3f626be7715886412313fc18f58b30dfcaf and reworks writeSession to use a std::wstring instead of the fixed MAX_PATH stack buffer; see https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.8 and the advisory at https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-pxgg-96p2-c3hx. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory Notepad++ installations and identify any version prior to 8.9.8, instruct users not to launch Notepad++ from untrusted shortcuts or portable packages, and confirm standard deployments use default settings directories. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today