CVE-2026-6539: Notepad-Plus-Plus Notepad++

Medium severity, CVSS 4.4. EPSS: 0.2% chance of exploitation in the next 30 days.

Notepad++ 8.9.3 contains a format string injection vulnerability in the Find Results panel handler that allows attackers to cause denial of service and information disclosure by crafting a malicious nativeLang.xml language pack file. Attackers can distribute a poisoned language pack through community channels that triggers format string interpretation when a user performs search operations, leading to access violations and potential leakage of stack or register contents.

Affected products

• Notepad-Plus-Plus Notepad++: version 8.9.3 only

Published 2026-04-30. Last modified 2026-06-17.