This vulnerability in Notepad++ 8.9.3 involves improper bounds checking in the file drop handler component. Specifically, when a directory path of exactly 259 characters is dragged and dropped without a trailing backslash, the software appends a backslash and null terminator to the path string without verifying buffer capacity. This leads to a stack-based buffer overflow, resulting in a crash with STATUS_STACK_BUFFER_OVERRUN. The CVSS 3.1 vector indicates the attack requires local access with low privileges, high attack complexity, and user interaction. Confidentiality and integrity impacts are high, but availability impact is not affected.

Successful exploitation causes a stack buffer overflow leading to application crash. The vulnerability impacts confidentiality and integrity, but does not affect availability. There are no known exploits in the wild. The attack requires local access, low privileges, and user interaction, with high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid dragging and dropping directory paths of exactly 259 characters without trailing backslashes in Notepad++ 8.9.3. Monitor vendor channels for updates and apply patches promptly once released.