TI-2026-05734 Aliases CVE-2026-6539 GHSA-vfqp-r766-g759

Notepad++ 8.9.3 Format String Injection via nativeLang.xml

LOW 20CWE-134Published 2026-04-30 · Updated 2026-07-28

Key facts

Attack vector: Local
Privileges required: None
User interaction: Active
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: Low · None · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Notepad++ 8.9.3 contains a format string injection vulnerability in the Find Results panel handler that allows attackers to cause denial of service and information disclosure by crafting a malicious nativeLang.xml language pack file. Attackers can distribute a poisoned language pack through community channels that triggers format string interpretation when a user performs search operations, leading to access violations and potential leakage of stack or register contents.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00191 8th percentileScored 2026-11-07

Fix Fixed Notepad++ (Notepad++): 8.9.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Notepad++	Notepad++	before 8.9.4	8.9.4	Patch available	CNA

Notepad++ VendorNotepad++ Affected before 8.9.4 Fixed in 8.9.4 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:notepad-plus-plus:notepad\+\+:8.9.3:::::::*	8.9.3	Vulnerable	notepad-plus-plus

cpe:2.3:a:notepad-plus-plus:notepad\+\+:8.9.3:*:*:*:*:*:*:* Versions 8.9.3 Vulnerable ·notepad-plus-plus

Remediation

Fix · CNA Notepad++ (Notepad++) Fixed in 8.9.4

Timeline

2026-10-02 Threatist record created from CVE-2026-6539
2026-10-03 Alias added: GHSA-vfqp-r766-g759

References

Patch 1

https://notepad-plus-plus.org/news/v894-released/

TI-2025-14195 Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification KEVCVSS 4.0HIGH 7.7
TI-2026-02597 Vulnerability in Notepad++ CVSS 3.1MEDIUM 6.6
TI-2007-02577 Stack-based buffer overflow in LexRuby.cxx (SciLexer.dll) in Scintilla 1.73, as used by… CVSS 2.0HIGH 7.6
TI-2008-03296 The GUP generic update process in Notepad++ before 4.8.1 does not properly verify the… CVSS 2.0HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences