{
  "cveId": "CVE-2026-86054",
  "url": "https://patchblox.com/security/cve/CVE-2026-86054",
  "summary": "CVE-2026-86054 is fixed in Notepad\u002B\u002B on 1 platform by Notepad\u002B\u002B 8.9.8 (version 8.9.8), released August 23, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "Notepad\u002B\u002B: Stack Buffer Overflow in \u0060NppParameters::writeSession\u0060 via overlong session path",
  "description": "Notepad\u002B\u002B is a free and open-source source code editor. Prior to 8.9.8, Notepad\u002B\u002B contains a stack buffer overflow in NppParameters::writeSession in PowerEditor/src/Parameters.cpp because it copies a session path derived from -settingsDir= into backupPathName[MAX_PATH] with unbounded wcscpy and appends SESSION_BACKUP_EXT with unbounded wcscat. A sufficiently long settings directory causes the backup suffix to exceed the fixed stack buffer when Notepad\u002B\u002B saves the session, and the protected release build terminates through its stack canary, causing denial of service. This issue is fixed in version 8.9.8.",
  "published": "2026-09-22T18:17:23Z",
  "severity": "",
  "cvss": 7.8,
  "cwe": "CWE-121: Stack-based Buffer Overflow",
  "epss": 0.00228,
  "epssPercentile": 0.1363,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://nvd.nist.gov/vuln/detail/CVE-2026-86054",
  "fixes": [
    {
      "platform": "windows-app",
      "product": "Notepad\u002B\u002B",
      "fixedVersion": "8.9.8",
      "fix": "Notepad\u002B\u002B 8.9.8",
      "url": "https://patchblox.com/security/fix/windows-app/notepad-.notepad-8.9.8",
      "released": "2026-08-23T00:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T07:25:28Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}