Notepad++ 8.9.7 Security Patch: Fixes Zip Slip, Buffer Overflow, PowerShell Injection

Notepad++, the ubiquitous Windows text editor favored by developers and power users, released version 8.9.7 on July 14, 2026, addressing five security flaws that underscore how seemingly small utilities can present significant attack surfaces when they process untrusted input.

The update, codenamed “Slava Ukraini,” patches three CVE-tracked vulnerabilities and two additional issues published as GitHub Security Advisories; together they affect session-file handling, environment-variable expansion, ZIP extraction, macro validation, and the installer’s interaction with PowerShell.

Of particular concern is CVE-2026-54758, a stack buffer overflow in the expandNppEnvironmentStrs function that can be triggered when environment-string input exceeds the allocated stack buffer; in practice, this flaw can cause crashes, memory corruption, and, under certain conditions, arbitrary code execution if an attacker can feed crafted input into the environment expansion routine.

Notepad++ 8.9.7 Security Patch

Another critical fix, CVE-2026-57233, mitigates a classic Zip Slip path-traversal vulnerability in Notepad++’s archive extraction logic, where specially crafted ZIP entries containing traversal sequences (for example, “../”) could overwrite files outside the intended extraction directory and potentially replace configuration or startup files used by the current user.

The release also resolves CVE-2026-52886, a starts_with bypass in validation of the backupFilePath setting inside session.xml: path-validation checks that only look at raw prefixes can be subverted after path normalization or traversal, allowing malicious session files to reference locations outside expected directories.

Two further advisories, one tracking an HMAC bypass in shortcuts.xml related to macro integrity and another describing an install-time PowerShell command injection risk, round out the set of fixes;

The former could allow tampered macro definitions to be accepted if integrity checks are circumvented, while the latter shows how installer-supplied or attacker-controlled input passed unsafely to PowerShell can permit arbitrary commands to run with the privileges of the installing user.

Together, these issues illustrate recurring themes in application security: the dangers of insufficient input validation, unsafe handling of archive contents, and trusting configuration files or installer parameters that may be shared or downloaded from untrusted sources.

Notepad++’s guidance is straightforward, download installers only from official project channels, update to v8.9.7 promptly, and exercise caution with unsolicited archives, session files, and shared configuration blobs, yet the operational reality matters too, especially for organizations:

Environments that exchange Notepad++ settings, use shared workspaces, or automate installs at scale should prioritize this patch, scan for instances of vulnerable versions, and consider restricting which users can install or run potentially unsafe installers.

Beyond security, the 8.9.7 release also delivers usability improvements, Folder as Workspace now preserves expanded/collapsed state between sessions and Incremental Search displays nth/count information for matches, plus miscellaneous bug fixes. The Notepad++ project has opened a regression and critical-bug reporting thread on its community forum for