Loading vulnerability…
CVE-2026-3008 is a format string injection vulnerability in Notepad++ affecting versions before 8.9.4, including 8.9.3. The flaw is in the FindInFiles functionality and is triggered when the localized string stored in the nativeLang.xml configuration file for the find-result-hits field contains uncontrolled format specifiers such as %s. During search result rendering, the application passes this attacker-controlled string to formatting logic based on wsprintfW, causing format specifiers to be interpreted rather than treated as literal text. This can lead to invalid memory dereferences and application crashes, or to disclosure of process memory values such as memory addresses when hexadecimal format specifiers are used. Available reporting indicates the issue was fixed in Notepad++ 8.9.4 as part of the crash fix for FindInFiles handling of malformed find-result-hits content.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small proof-of-concept exploit package for CVE-2026-3008 affecting Notepad++ 8.9.3 on Windows. It is not tied to a common exploit framework. The repo contains one explanatory README and three XML payload files under payloads/. The exploit is file-based and local in delivery: it relies on replacing or planting a malicious nativeLang.xml localization file that Notepad++ loads when localization is enabled. The vulnerable data flow described in the README is nativeLang.xml -> TinyXML parser -> NativeLangSpeaker UTF conversion -> sub_140099E60 -> wsprintfW, where the <find-result-hits> attribute is used directly as a format string. Because wsprintfW is invoked with only the format string and no matching variadic arguments, attacker-supplied specifiers read stale register/stack values. The provided payloads demonstrate two practical outcomes: reliable denial of service using repeated %s specifiers that dereference invalid pointers and crash Notepad++, and information disclosure using %08lx or %x specifiers that render stack/register-derived values in the Find Results panel. The README explicitly notes that wsprintfW does not support %n and that the output limit matches the destination buffer, so the demonstrated impact is limited to crash and memory disclosure rather than code execution. Repository structure is straightforward: README.md documents the vulnerability, trigger conditions, affected functions and addresses, and exploitation constraints; payloads/formatstring_crash.xml provides a crash-oriented payload; payloads/formatstring_leak.xml provides a memory disclosure payload; payloads/formatstring_perX.xml provides a simpler hexadecimal leak variant. The exploit triggers when the victim performs a search operation that yields results, including Find All, Find in Files, Replace All, or Mark All.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A string-injection vulnerability in Notepad++ that affects version 8.9.3 and may allow attackers to access sensitive memory information or crash the application. The issue was fixed in Notepad++ version 8.9.4.
A string injection / format string vulnerability in Notepad++ FindInFiles that can crash the application or disclose memory address information, potentially aiding further exploitation such as ASLR bypass.
A string injection vulnerability whose successful exploitation could allow an attacker to obtain memory address information or crash the application.
A format string vulnerability in Notepad++'s handling of nativeLang.xml that can cause denial of service via application crash and disclose memory contents, but the content states remote code execution is not achievable.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.