CVE-2026-6539

Executive Summary

CVE-2026-6539 is a format string injection vulnerability discovered in Notepad++ version 8.9.3. The flaw resides in the Find Results panel handler, which improperly processes user-supplied format specifiers (e.g., %s, %x, %n) embedded in a malicious nativeLang.xml language pack file. An attacker can distribute a poisoned language pack through community channels (forums, GitHub issues, or third-party repositories). When a victim performs a search operation, the vulnerable code interprets the format specifiers, leading to an access violation (denial of service) and potential leakage of stack or register contents (information disclosure). The CVSS score is 4.4 (Medium), with a local attack vector and low complexity. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk is elevated for targeted attacks against developers or analysts using Notepad++.

Supply Chain & Package Security

Notepad++ is a widely used text editor distributed via its official website and GitHub releases. The vulnerability is introduced through a malicious language pack file (nativeLang.xml), which is a configuration file that can be replaced by users. This represents a supply chain risk: an attacker could compromise a community mirror or a third-party repository hosting language packs, or trick users into downloading a poisoned pack via social engineering. The patch is available in version 8.9.4, which sanitizes format specifiers in the Find Results panel.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – The attacker must have local access to the system or trick the user into loading a malicious file.
• Attack Complexity (AC): Low (L) – No special conditions required beyond user interaction.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must open the malicious language pack and perform a search.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Limited information disclosure (stack/register contents).
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Denial of service via access violation.

Threat Level: Medium. The vulnerability requires user interaction and local access, but it can lead to DoS and information leakage. In a targeted attack, an adversary could use this to leak sensitive data from a developer’s environment.

Deep Dive & Mechanics

The vulnerability is a classic format string injection (CWE-134). In Notepad++ 8.9.3, the Find Results panel uses a function that passes user-controlled strings (from nativeLang.xml) directly to a format string function (e.g., printf or sprintf). The nativeLang.xml file contains localized strings for the UI. An attacker can craft a malicious version of this file with format specifiers like %s, %x, %n, or %p in the search result messages.

When the user performs a search operation, the vulnerable code constructs a message using the poisoned string. For example, if the string is "Found %s at line %d", the code might call printf(buffer, user_input). If user_input contains %x%x%x, the function will read from the stack, leaking memory contents. If it contains %n, it can write to memory, potentially causing a crash or code execution (though the CVE only mentions DoS and info disclosure).

The attack flow:

1. Attacker creates a malicious nativeLang.xml with format specifiers in search-related strings.
2. Attacker distributes the file via community channels (e.g., Notepad++ forum, GitHub issues, or a fake language pack site).
3. Victim downloads and places the file in the Notepad++ localization folder.
4. Victim opens Notepad++ and performs a search (e.g., Ctrl+F).
5. The Find Results panel processes the poisoned string, triggering the format string vulnerability.
6. The application crashes (DoS) or leaks stack/register data (info disclosure).

Vulnerable vs. Patched Code

Vulnerable Code (Notepad++ 8.9.3): The Find Results panel likely uses a function similar to:

void DisplaySearchResult(const char* format, ...) {
    char buffer[1024];
    vsnprintf(buffer, sizeof(buffer), format, ...); // format is user-controlled
    // Display buffer in the panel
}

In the vulnerable version, the format parameter is taken directly from the language pack without sanitization.

Patched Code (Notepad++ 8.9.4): The patch introduces input validation to escape or reject format specifiers in the language pack strings. For example:

void DisplaySearchResult(const char* format, ...) {
    char buffer[1024];
    // Sanitize: replace % with %% to prevent format string interpretation
    char sanitized[1024];
    int j = 0;
    for (int i = 0; format[i] != '\0' && j < sizeof(sanitized)-1; i++) {
        if (format[i] == '%') {
            sanitized[j++] = '%';
            sanitized[j++] = '%';
        } else {
            sanitized[j++] = format[i];
        }
    }
    sanitized[j] = '\0';
    vsnprintf(buffer, sizeof(buffer), sanitized, ...);
    // Display buffer in the panel
}

Alternatively, the patch may use a fixed format string like "%s" and pass the user string as an argument, preventing injection.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Windows 10/11 VM with Notepad++ 8.9.3 installed.
• A text file with some content (e.g., test.txt with "Hello World").
• A malicious nativeLang.xml file.

Steps:

1. Create a malicious nativeLang.xml with format specifiers in the search result strings. For example:

<?xml version="1.0" encoding="UTF-8"?>
<NotepadPlus>
    <Native-Lang>
        <Find-Result>
            <String id="0">%x.%x.%x.%x.%x</String>
        </Find-Result>
    </Native-Lang>
</NotepadPlus>

2. Place the file in %PROGRAMFILES%\Notepad++\localization\ (or the user's AppData folder).
3. Open Notepad++ and load the malicious language pack via Settings > Preferences > Localization.
4. Open test.txt and perform a search (Ctrl+F) for any string (e.g., "Hello").
5. Observe the Find Results panel: it will display hex values from the stack (info disclosure) or crash the application (DoS).

Expected Output:

• The Find Results panel shows stack data like 12FFB0.401234.0.0.0.
• Or Notepad++ crashes with an access violation.

Blue Team (Defensive)

Detection:

• Monitor for unexpected crashes of Notepad++ (Event ID 1000 in Windows Application log).
• Monitor file system changes to nativeLang.xml in the Notepad++ localization folder.
• Use YARA rules to scan for format specifiers in language pack files.

Mitigation:

• Update to Notepad++ 8.9.4 or later.
• Restrict write access to the Notepad++ installation folder.
• Educate users not to download language packs from untrusted sources.
• Use application whitelisting to prevent unauthorized modifications.

Indicators of Compromise (IOCs)

• File: nativeLang.xml containing format specifiers (e.g., %s, %x, %n, %p).
• Process: Notepad++.exe crashing with exception code 0xC0000005 (access violation).
• Registry: (Optional) Notepad++ settings pointing to a malicious localization file.
• Network: No network IOCs, as the attack is local.
• Logs: Windows Application Event Log with Event ID 1000 for Notepad++.exe.

Detection Engineering

YARA Rule

rule CVE_2026_6539_Malicious_LangPack {
    meta:
        description = "Detects malicious nativeLang.xml files with format string specifiers"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-6539"
    strings:
        $fmt1 = "%s" ascii wide nocase
        $fmt2 = "%x" ascii wide nocase
        $fmt3 = "%n" ascii wide nocase
        $fmt4 = "%p" ascii wide nocase
        $xml_tag = "<Native-Lang>" ascii wide nocase
    condition:
        $xml_tag and (any of ($fmt*))
}

Sigma Rule

title: CVE-2026-6539 - Notepad++ Format String Injection via Language Pack
id: 8a3b2c1d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects Notepad++ crashes or suspicious nativeLang.xml modifications
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\Notepad++.exe'
        CommandLine|contains: 'nativeLang.xml'
    condition: selection
falsepositives:
    - Legitimate language pack updates
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-6539 - Potential Notepad++ Language Pack Download"; flow:to_server; content:"nativeLang.xml"; http_uri; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Update Notepad++ to version 8.9.4 or later from the official website.
2. Compensating Controls: If update is not possible, disable the Find Results panel or restrict write access to the localization folder.
3. User Awareness: Train users to only download language packs from the official Notepad++ repository.
4. Monitoring: Deploy YARA rules to scan for malicious nativeLang.xml files in the environment.
5. Application Control: Use AppLocker or similar to prevent unauthorized modifications to Notepad++ files.

Valters IT
DevSecOps & Cyber Threat Intelligence
Report generated for CVE-2026-6539

{/* [Security Hash: B22A4CCB6553F2668A910CFC] */}