Skip to content
Cve 2026 3008

Cve 2026 3008

llgsjsm.github.io • April 27, 2026

a format string injection vulnerability in Notepad++ 8.9.3 allows an attacker to cause a reliable crash (DoS) or leak stack/register contents via a malicious language pack

github: llgsjsm/cve-2026-3008

on a casual thursday, i decided to pass some time by looking into some popular applications instead of doom scrolling my life away. notepad++ was one of them, we get on with tinkering shall we??

i can just distribute the malicious nativeLang.xml and pass it off as a legitimate language pack in the npp community forums. when the user unknowingly load up his npp, and tries to a matching term – it will crash every. single. time.

best part? a normal user wouldnt even know why it crashes

asides causing mischief from crashing however, this exploit can expose registers/stack values. with a write primitive you can… (or maybe not)

function: sub_1400916C0 — Find Results panel initializer vulnerable instruction: 0x140091E6D triggered by: any operation that produces results (Find All, Find in Files, Mark All)

sub_140099E60 retrieves an attacker-controlled string from nativeLang.xml and places it in v38.

wsprintfW is then called with v38 as the format string argument, not as a data argument — so any format specifiers in the XML value ( %s , %x ) are interpreted by wsprintfW.

the string originates from the attribute in nativeLang.xml with no validation at any point in the data flow:

crash (denial of service): the payload %s%s%s%s%s%s%s%s causes an immediate access violation since wsprintfW dereferences junk register/stack values as WCHAR* pointers, hitting an invalid address. tested and confirmed on notepad++ 8.9.3 x64

information disclosure: %x and %08lx specifiers leak stack and register contents into the Find Results panel tab. heres the output for %08lx :

wsprintfW does not support %n , so there is no write primitive hence theres no avenue for code execution (sad)

create nativeLang.xml with this payload:

then open Notepad++, for any text, and click Find All in Current Document . Notepad++ crashes immediately