CVE-2026-54758: falha de alta gravidade em notepad-plus-plus
Notepad++: Stack Buffer Overflow in expandNppEnvironmentStrs
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.8epss 0.2%
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the expandNppEnvironmentStrs function in PowerEditor/src/WinControls/StaticDialog/RunDlg/RunDlg.cpp copies a Notepad++ variable name between $( and ) into the fixed-size wchar_t str[MAX_PATH] stack buffer without bounding the m loop index, allowing a name of 260 or more characters to corrupt adjacent stack data, terminate the process through __report_gsfailure, and potentially execute code. This issue is fixed in version 8.9.7.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
notepad-plus-plus · notepad-plus-plusCVEs relacionadas — notepad-plus-plus
No mesmo produto, das mais perigosas para as menos.
CVE-2025-15556HIGHNotepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity VerificationEPSS 1.7%KEVCVE-2022-32168HIGHnotepad-plus-plus - DLL HijackingEPSS 0.8%CVE-2025-49144HIGHNotepad++ Privilege Escalation in Installer via Uncontrolled Executable Search PathEPSS 0.7%CVE-2026-48778HIGHNotepad++: Arbitrary Code Execution via config.xml commandLineInterpreterEPSS 0.6%CVE-2023-40031HIGHNotepad++ vulnerable to heap buffer write overflow in Utf8_16_Read::convertEPSS 0.5%CVE-2026-57233HIGHNotepad++: Path Traversal (Zip Slip) in WinGup Plugin ExtractionEPSS 0.5%