CVE-2026-86054

Name of the Vulnerable Software and Affected Versions Notepad++ versions prior to 8.9.8

Description A stack buffer overflow exists in the NppParameters::writeSession function within PowerEditor/src/Parameters.cpp. The issue occurs when the software copies a session path derived from the -settingsDir= parameter into the backupPathName[MAX PATH] buffer using an unbounded wcscpy and subsequently appends SESSION BACKUP EXT using an unbounded wcscat. A sufficiently long settings directory can cause the backup suffix to exceed the fixed stack buffer during session saving, triggering a stack canary termination and resulting in a denial of service.

Recommendations Update to version 8.9.8.