Notepad++ 8.9.3 contains a format string injection vulnerability in the Find Results panel handler that allows attackers to cause denial of service and information dis…

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Apr 30, 2026 · NIST NVD

   Detected

   Notepad++ 8.9.3 contains a format string injection vulnerability in the Find Results panel handler that allows attackers to cause denial of service and information disclosure by crafting a malicious nativeLang.xml language pack file. Attackers can distribute a poisoned language pack through community channels that triggers format string interpretation when a user performs search operations, leadin

2. Jun 17, 2026 · NIST NVD

   Updated

   Notepad++ 8.9.3 contains a format string injection vulnerability in the Find Results panel handler that allows attackers to cause denial of service and information disclosure by crafting a malicious nativeLang.xml language pack file. Attackers can distribute a poisoned language pack through community channels that triggers format string interpretation when a user performs search operations, leadin

Affected

• cpe notepad-plus-plus/notepad++8.9.3

Sources

• CVE.orgVulnerability recordCVE-2026-6539

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-6539

  Notepad++ 8.9.3 contains a format string injection vulnerability in the Find Results panel handler that allows attackers to cause denial of service and information disclosure by crafting a malicious nativeLang.xml language pack file. Attackers can distribute a poisoned language p

  nvd.nist.gov

References

• Release Notes · notepad-plus-plus.org
• Third Party Advisory · vulncheck.com