Notepad++ nativeLang.xml Format String Crash / Info Disclosure — CVE-2026-3008

Metadata

Affected Target

Summary

Notepad++’s Find Results panel initializer (sub_1400916C0) retrieves the localized find-result-hits string from nativeLang.xml and passes it directly as the format string argument to wsprintfW, with no accompanying variadic data arguments and no validation of the string’s content anywhere in the data flow from XML parsing through UTF-16 conversion. A tampered nativeLang.xml containing format specifiers (e.g. %s, %08lx) in the find-result-hits attribute causes wsprintfW to read leftover register/stack values as pointers or integers whenever a search operation (Find All, Find in Files, Replace All, Mark All) populates the Find Results panel, causing a crash or leaking process memory contents into the UI.

Vulnerability Details

Root Cause

sub_1400916C0 calls wsprintfW((LPWSTR)(a1 + 0xC8), v38) where v38 is a localized string read verbatim from nativeLang.xml’s find-result-hits attribute, with no format-string sanitization and no data arguments supplied — any % specifiers in the string are evaluated against undefined register/stack contents.

Attack Vector

1. Attacker crafts or tampers with a nativeLang.xml community language pack, embedding format specifiers into the <find-result-hits value="..."/> attribute (43 of 94 shipped language files contain this element).
2. Attacker distributes the file via forums/download sites as a “translation,” with all other strings translated normally to appear legitimate.
3. Victim installs the language pack and switches Notepad++’s UI language to it (Settings → Preferences → General → Localization), or the file is placed at %APPDATA%\Notepad++\nativeLang.xml (installer) or <npp_directory>\nativeLang.xml (portable).
4. Any subsequent search operation that populates the Find Results panel (Find All, Find in Files, Replace All, Mark All) triggers wsprintfW with the malicious format string.

Impact

%s-style payloads cause a reliable access violation crash (STATUS_ACCESS_VIOLATION) on every subsequent search — persistent denial of service. %08lx-style payloads leak stack/register contents (including truncated pointer fragments) into the visible Find Results tab — information disclosure. No %n write-what-where primitive exists via wsprintfW, and the destination buffer’s 1024-character limit matches the API’s own cap, ruling out code execution via this bug alone.

Environment / Lab Setup

Target:   Notepad++ 8.9.3 with a non-English nativeLang.xml language pack installed
Attacker: Any text/XML editor to craft the malicious nativeLang.xml

Proof of Concept

PoC Script

See payloads/formatstring_crash.xml, payloads/formatstring_leak.xml, and payloads/formatstring_perX.xml in this folder.

1
2

copy payloads\formatstring_crash.xml "%APPDATA%\Notepad++\nativeLang.xml"
:: restart Notepad++, run Find All / Find in Files / Replace All / Mark All

formatstring_crash.xml embeds repeated %s specifiers to trigger an immediate access violation on the next search; formatstring_leak.xml and formatstring_perX.xml embed %08lx-style specifiers to leak stack/register contents (including pointer fragments) into the Find Results tab instead of crashing.

Detection & Indicators of Compromise

Signs of compromise:

• Repeated Notepad++ crashes correlated with switching to a non-default UI language
• A nativeLang.xml file with unusually formatted find-result-hits attributes
• Hex-looking garbage strings appearing in the Find Results panel tab title/content

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/llgsjsm/cve-2026-3008 on 2026-07-05.