Notepad++ Project vulnerabilities and threats

CVE-2026-5525 is a stack-based buffer overflow vulnerability in Notepad++ version 8.9.3. It occurs in the file drop handler when a user drags and drops a directory path of exactly 259 characters without a trailing backslash. The application appends a backslash and null terminator without proper bounds checking, causing a stack buffer overflow and application crash. The vulnerability has a medium severity with a CVSS score of 6. No patch or official remediation is currently available, and there are no known exploits in the wild.