A stack-based buffer overflow exists in Notepad++ 8.9.3’s file drop handler, triggered when a user drags and drops a directory path of exactly 259 characters without a trailing backslash. The application appends a backslash and null terminator without performing bounds checking, causing a stack overflow that leads to process termination (STATUS_STACK_BUFFER_OVERRUN). This results in a denial‑of‑service condition, allowing an attacker to crash Notepad++ when they control the path length and can execute the drop.

The vulnerability affects the Notepad++ project’s product, Notepad++. Only version 8.9.3 is known to be impacted; later releases have reportedly patched the flaw.

The CVSS score of 6.0 indicates moderate severity, and the EPSS value is not available. The defect is not listed in the CISA KEV catalog and appears to be exploitable only by local users able to perform a drag‑and‑drop operation. Consequently, the primary risk is a local denial of service to anyone operating Notepad++ on the affected system.