CVE-2026-5525

HighCVSS 7.8/10Last modified Oct 26, 2026

Description

A stack-based buffer overflow vulnerability exists in Notepad++ version 8.9.3 in the file drop handler component. When a user drags and drops a directory path of exactly 259 characters without a trailing backslash, the application appends a backslash and null terminator without proper bounds checking, resulting in a stack buffer overflow and application crash (STATUS_STACK_BUFFER_OVERRUN).

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121

Affected software

Vendor	Product	Versions
Notepad++ Project	Notepad++	8.9.3

References

https://github.com/notepad-plus-plus/notepad-plus-plus/commit/bfe7514d68bc559534c046c4ef2d1865267aa2b0Patch
https://github.com/notepad-plus-plus/notepad-plus-plus/issues/17921Exploit, Issue Tracking, Mitigation, Vendor Advisory
https://github.com/notepad-plus-plus/notepad-plus-plus/pull/17930Issue Tracking, Patch
https://github.com/notepad-plus-plus/notepad-plus-plus/issues/17921Exploit, Issue Tracking, Mitigation, Vendor Advisory

Timeline

Published: Apr 10, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-552508.7Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0 has a high-severity Token Replay Vulnerability aris CVE-2026-552516.5NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CVE-2026-552525.1OpenRun is an open-source, self-hosted GitOps platform for deploying web apps and internal tools to Docker or Kubernetes. Prior to version 0 CVE-2026-552537.7LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph. Prior to langgraph-checkpoint-mongodb 0.3.0 and la CVE-2026-552546.5NCalc is a fast, lightweight expression evaluator for .NET. Prior to 6.1.1, the factorial operator implementation in src/NCalc.Core/Helpers/CVE-2026-552558.4Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vu CVE-2026-552566.5In parsePartHeaders of multiple files, there is a possible persistent denial of service due to improper input validation. This could lead to CVE-2026-552578.4In UsbDialogHelper of UsbDialogHelper.java, there is a possible UI confusion due to misleading or insufficient UI. This could lead to local CVE-2026-55269.8A security flaw has been discovered in Tenda 4G03 Pro up to 1.0/1.1/04.03.01.53/192.168.0.1. Affected by this vulnerability is an unknown fu CVE-2026-552618.4In nfa_t4tnfcee_store_rx_buf of nfa_nfcee_act.cc, there is a possible way to achieve code execution due to a missing permission check. This CVE-2026-552628.4In setNotificationListenerAccessGrantedForUserInternal of NotificationManagerService.java, there is a possible policy desynchronization due CVE-2026-552638.4In multiple functions of AllowBindAppWidgetActivity.java, there is a possible misunderstanding of reject/consent actions due to misleading o