PT-2026-35357 · Notepad++ · Notepad++

Hazley Samsudin · Published 2026-04-27 · Updated 2026-05-25 · CVE-2026-3008

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions Notepad++ versions prior to 8.9.4

Description A string injection issue exists in the FindInFiles search function due to flaws in the formatting string processing mechanism. Successful exploitation could allow an attacker to obtain sensitive memory address information or cause the application to crash (denial of service) by using a specially crafted file. This risk is particularly relevant for users utilizing custom nativeLang.xml localization files.

Recommendations Update to version 8.9.4 or later. Avoid using untrusted configuration or localization files.

Exploit

Fix

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

BDU:2026-06063

CVE-2026-3008

Affected Products

Notepad++

References · 33

• 🔥 https://github.com/llgsjsm/cve-2026-3008 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-3008 · Security Note
• https://bdu.fstec.ru/vul/2026-06063 · Security Note
• https://github.com/notepad-plus-plus/notepad-plus-plus/issues/17960 · Note
• https://twitter.com/lyrie_ai/status/2058756465062510641 · Twitter Post
• https://twitter.com/Privacy321US/status/2048719436010377567 · Twitter Post
• https://twitter.com/UpwindMDR/status/2048808269628530769 · Twitter Post
• https://t.me/cveNotify/161026 · Telegram Post
• https://twitter.com/UndercodeUpdate/status/2049003944358171012 · Twitter Post
• https://twitter.com/CVEnew/status/2048852253830783252 · Twitter Post
• https://llgsjsm.github.io/cve-2026-3008 · Note
• https://community.notepad-plus-plus.org/topic/27500/notepad-v8-9-4-release-candidate · Note
• https://twitter.com/Xploitzone_01/status/2049104923548389623 · Twitter Post
• https://twitter.com/lyrie_ai/status/2058756463007334900 · Twitter Post
• https://twitter.com/UndercodeUpdate/status/2048818395458527331 · Twitter Post