PT-2026-36185 · Notepad++ · Notepad++

Hazley Samsudin · Published 2026-04-30 · Updated 2026-04-30 · CVE-2026-6539

Mitre

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

Notepad++ 8.9.3 contains a format string injection vulnerability in the Find Results panel handler that allows attackers to cause denial of service and information disclosure by crafting a malicious nativeLang.xml language pack file. Attackers can distribute a poisoned language pack through community channels that triggers format string interpretation when a user performs search operations, leading to access violations and potential leakage of stack or register contents.

Fix

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

CVE-2026-6539

Affected Products

Notepad++

References · 3

• https://notepad-plus-plus.org/news/v894-released · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-6539 · Security Note
• https://vulncheck.com/advisories/notepad-format-string-injection-via-nativelang-xml · Note