PT-2026-36185 · Notepad++ · Notepad++

Hazley Samsudin · Published 2026-04-30 · Updated 2026-05-25 · CVE-2026-6539

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions Notepad++ version 8.9.3

Description A format string injection exists in the Find Results panel handler. This occurs when the application processes a maliciously crafted nativeLang.xml language pack file. An attacker can distribute a poisoned language pack through community channels; when a user performs search operations, the application triggers format string interpretation. This can lead to access violations, denial of service, and the potential leakage of stack or register contents (information disclosure).

Recommendations As a temporary workaround, avoid installing or using untrusted nativeLang.xml language packs from community channels.

Fix

DoS

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

CVE-2026-6539

Affected Products

Notepad++

References · 5

• https://notepad-plus-plus.org/news/v894-released · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-6539 · Security Note
• https://twitter.com/CVEnew/status/2049955991274541210 · Twitter Post
• https://vulncheck.com/advisories/notepad-format-string-injection-via-nativelang-xml · Note
• https://twitter.com/lyrie_ai/status/2058756465062510641 · Twitter Post