A buffer overflow occurs in the NppParameters::writeSession routine when a session is saved. The code copies the settings directory path – supplied via the -settingsDir option – into a fixed‑size buffer without bounds checking, then concatenates a backup suffix. If the directory name is long enough, the concatenation overruns the stack buffer, triggering the stack canary and causing the protected release build to terminate. The vulnerability therefore results in an application crash and interruption of service, but it does not grant code execution.

Notepad++ versions earlier than 8.9.8 on Windows are affected. The vulnerability is present in the source code referenced in the official GitHub repository and fixed in the 8.9.8 release; any installation using an older version and a long settings directory path is at risk.

The CVSS score of 7.8 indicates a high severity, reflecting the significant loss of availability and the lack of mitigation in the affected builds. No EPSS score is available, so the exploitation probability cannot be quantified. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no public exploits have been reported. Likely attack conditions require a local user or a process with access to Notepad++ to trigger the overflow by saving a session after configuring an overlong settings directory path. No remote trigger or privilege escalation is required. Given the lack of a remote exploit vector and the existing stack canary, the risk is confined to local denial of service on the affected system.