Notepad++ maintainers have shipped version 8.9.7, addressing five security vulnerabilities, ranging from a stack buffer overflow to path-traversal flaws in the built-in updater and configuration files.
The widely used open-source text editor, which serves millions of Windows users, including developers and IT administrators, patches issues that could enable local privilege escalation, bypass security controls, and potentially allow remote code execution during updates.
The most severe issue, tracked as CVE-2026-54758, involves a stack buffer overflow in the expandNppEnvironmentStrs function.
Notepad++ Security Update
This flaw could allow an attacker to corrupt memory and potentially execute arbitrary code by supplying crafted environment strings that the application fails to bound-check before processing.
Two additional vulnerabilities affect configuration file handling. CVE-2026-52886 permits attackers to bypass path validation in session.xml through manipulation of the backupFilePath field’s starts_with check, potentially allowing files to be written or read outside intended directories.
A related flaw, currently without an assigned CVE, involves an HMAC bypass in shortcuts.xml that could allow attackers to tamper with macro definitions without detection, undermining the integrity verification intended to prevent malicious macro injection.
Perhaps most concerning for enterprise environments is CVE-2026-57233, a Zip Slip (path traversal) vulnerability in WinGUp, Notepad++’s auto-updater component.
Zip Slip flaws exploit insufficient validation of archive entry paths during extraction, allowing malicious ZIP files to write to arbitrary filesystem locations outside the intended extraction directory.
If an attacker can intercept or spoof update packages, this flaw could enable code execution with the privileges of the updater process.
Rounding out the disclosures, an unassigned CVE addresses a PowerShell command injection vulnerability in the Notepad++ installer, where insufficiently sanitized input during install-time scripting could allow injected commands to execute with installer privileges.
| CVE ID | Vulnerability | Component |
|---|---|---|
| CVE-2026-52886 | session.xml backupFilePath starts_with bypass | Session file handling |
| CVE-2026-54758 | Stack buffer overflow in expandNppEnvironmentStrs | Environment string expansion |
| CVE-2026-57233 | Zip Slip (path traversal) | WinGUp updater |
| Not yet assigned (GHSA-f4rj-vqq4-wvg4) | shortcuts.xml macro HMAC bypass | Macro integrity verification |
| Not yet assigned (GHSA-gp2r-262h-9hgf) | PowerShell command injection | Installer |
Beyond the security fixes, v8.9.7 introduces quality-of-life improvements including persistent expand/collapse states for Folder as Workspace sessions across restarts and enhanced Incremental Search with “nth of count” match indicators.
The release also resolves a long-standing “Find in Files” unresponsiveness bug, fixes a regression affecting relative file path handling, and addresses freezes caused by directory symbolic links in Folder as Workspace.
Under the hood, the update bumps Scintilla to 5.6.4, Lexilla to 5.5.1, and pugixml to v1.16. Notepad++’s auto-updater is scheduled to push this release to users automatically within two weeks if no regressions surface.
Given that two of the five patched flaws directly involve the update mechanism itself, security teams and IT administrators managing Notepad++ deployments should prioritize manual updates over automated rollouts, particularly in environments where the editor runs with elevated privileges or handles sensitive configuration files.
Give your SOC the intelligence it needs to act with confidence.
Explore ANY.RUN Threat Intelligence Feeds to reduce noise and improve operational efficiency.
