The flaw is a stack buffer overflow in Notepad++ 8.9.6 and earlier. The expandNppEnvironmentStrs routine copies a variable name into a fixed‑size wchar_t array without bounds checking, so a name of 260 or more characters overwrites adjacent stack memory. An attacker can cause the process to terminate or, if the overflow is properly leveraged, execute arbitrary code, thereby compromising the system. The weakness is identified as a stack‑based buffer overflow (CWE-121) and an out‑of‑bounds write (CWE-787).

All releases of Notepad++ prior to version 8.9.7 are affected. The bug appears in the PowerEditor module of the Windows build and is not specific to any particular OS version. The only known fix is the update to 8.9.7 and later. Any environment that continues to run an unpatched version remains vulnerable.

The CVSS score of 7.8 indicates a high severity. No EPSS score is available, and the vulnerability is not listed in CISA KEV, implying no known active exploitation. The code path is triggered by user‑supplied data; based on the description, the likely attack vector is local execution, where a user can provide a long environment variable name to trigger the overflow, potentially leading to code execution or denial of service.