Notepad++ 8.9.3 contains a format string injection vulnerability in the Find Results panel handler that allows attackers to cause denial of service and information disclosure by crafting a malicious nativeLang.xml language pack file. Attackers can distribute a poisoned language pack through community channels that triggers format string interpretation when a user performs search operations, leading to access violations and potential leakage of stack or register contents.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Notepad Plus Plus | — | Upgrade NotepadPlusPlus to the latest version | May 4, 2026 | Apr 30, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub