A critical stack-based buffer overflow vulnerability in Notepad++ prior to version 8.9.8 allows attackers to achieve arbitrary code execution via malicious plugin interaction.

The software suffers from a stack-based buffer overflow (CWE-121) in the PluginsManager::loadPluginFromPath function. An attacker can trigger this condition by providing a malicious plugin that reports an excessive number of lexers, causing the application to write past the allocated stack buffer and corrupt control data.

The vulnerability carries a CVSS score of 8.6, reflecting its potential for complete system compromise. Successful exploitation allows an attacker to execute arbitrary code within the context of the Notepad++ process, leading to potential data theft, lateral movement within the network, or total system takeover. This risk is particularly significant for environments where Notepad++ is used to handle sensitive source code or configuration files.

Immediate Action: Update all Notepad++ installations to version 8.9.8 or later immediately to incorporate the necessary bounds checking.

Proactive Monitoring: Monitor endpoint process execution logs for suspicious Notepad++ behavior or unexpected child processes spawned by the editor.

Compensating Controls: Implement strict application control policies to prevent the loading of untrusted or unsigned plugins within the Notepad++ environment.

Public Exploit Available: No

Given the High severity of this flaw and the existence of a proof-of-concept, organizations must prioritize patching. Administrators should audit all systems for outdated versions of Notepad++ and enforce the update to version 8.9.8 to eliminate the vulnerable code path. Failing to address this vulnerability increases the risk of remote code execution should a user be induced to load a malicious plugin.