This vulnerability in Notepad++ 8.9.3 arises from improper bounds checking in the file drop handler component. Specifically, when a directory path of exactly 259 characters without a trailing backslash is dropped into the application, Notepad++ appends a backslash and null terminator to the path string without verifying buffer capacity. This leads to a stack-based buffer overflow resulting in a crash (STATUS_STACK_BUFFER_OVERRUN). The CVSS 3.1 vector indicates the attack requires local access with low privileges and user interaction, with high impact on confidentiality and integrity but no impact on availability.

Successful exploitation causes a stack buffer overflow leading to application crash. The CVSS score of 6 and vector indicate medium severity with potential high confidentiality and integrity impact, though no availability impact is noted. There are no reports of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid dragging and dropping directory paths of exactly 259 characters without trailing backslash into Notepad++ 8.9.3. Monitor vendor channels for updates and apply patches promptly once available.