The vulnerability is a stack buffer overflow in PluginsManager::loadPluginFromPath. The plugin’s GetLexerCount() return value is used as a loop counter to write to an array of 30 containers without checking against the maximum allowed lexers. If a plugin reports more than 30 lexers, the loop writes beyond the stack array and corrupts control data, allowing the attacker to execute arbitrary code in the Notepad++ process context. This flaw maps to CWE-121 and permits local code execution. The issue was resolved in version 8.9.8 of Notepad++.

Every installation of Notepad++ before release 8.9.8 is affected. The product is the desktop editor Notepad++ released by its open‑source community. Users running earlier builds without the fix are vulnerable whenever a plugin providing an inflated lexer count is loaded.

The CVSS score of 8.6 indicates high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Attack likely requires the presence of a malicious or compromised plugin; once such a plugin is loaded, the stack overflow can be triggered. An attacker with local knowledge of the target machine could create or install a plugin that reports an excessive lexer count to exploit the flaw. Because the flaw exists in code that is normally executed with the same privileges as the user, the attacker can gain arbitrary code execution without additional escalations.