CVE-2026-86056 in Notepad++
Summary
by MITRE • 09/22/2026
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the NPPM_SAVESESSION handler in PowerEditor/src/NppBigSwitch.cpp converts lParam to a sessionInfo pointer and dereferences its nbFile, files, and sessionFilePathName members without checking for null. A process running at the same or a higher Windows integrity level on the same desktop can send NPPM_SAVESESSION with a null lParam, immediately terminating Notepad++ and causing denial of service and loss of unsaved documents. This issue is fixed in version 8.9.8.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
Notepad++ is a widely utilized free and open-source source code editor that provides users with advanced text editing capabilities for various programming languages. The vulnerability identified involves the NPPM_SAVESESSION message handler located within the PowerEditor/src/NppBigSwitch.cpp file of versions prior to 8.9.8. This specific component is responsible for managing session states, allowing applications or scripts to save current editor sessions including open files and workspace configurations. The core technical flaw stems from a lack of input validation when processing this inter-process communication message. Specifically, the handler converts the lParam parameter directly into a pointer to a sessionInfo structure without performing any null checks before accessing its internal members such as nbFile, files, and sessionFilePathName.
This absence of defensive programming creates a classic NULL pointer dereference vulnerability. When an external process sends the NPPM_SAVESESSION message with a null value for lParam, the Notepad++ application attempts to read from memory address zero or another invalid location associated with the null pointer. In Windows operating systems, accessing protected system memory triggers an access violation exception that is not gracefully handled by the application logic in this context. Consequently, the process immediately terminates without warning or opportunity to recover data. This behavior classifies as a denial of service condition where the availability of the software is compromised through simple input manipulation rather than complex exploitation techniques.
The operational impact of this vulnerability is significant for users who rely on Notepad++ for critical development tasks involving unsaved work. Because the application crashes instantly upon receiving the malicious message, any documents currently open in the editor that have not been explicitly saved to disk are lost permanently unless recovery features were previously enabled and configured by the user. The attack vector requires a process running at the same or higher Windows integrity level on the same desktop session as Notepad++. This constraint limits remote exploitation but allows for local denial of service attacks from other applications, scripts, or potentially malicious software residing within the same security context. An attacker with local access could craft a simple program to send this specific message and disrupt the workflow of any user running Notepad++ on that machine.
From a classification perspective, this vulnerability aligns with CWE-476 which denotes NULL Pointer Dereference. It also relates to CWE-20 Improper Input Validation as the root cause is the failure to verify the validity of incoming parameters before use. In terms of adversary tactics, this behavior corresponds to ATT&CK technique T1529 System Shutdown or Reboot if viewed through the lens of disrupting system availability, although it more accurately fits under local denial of service patterns often seen in software reliability issues rather than targeted malicious disruption campaigns. The vulnerability highlights the importance of robust error handling and input sanitization even for messages that may be considered internal or trusted within a single application context when inter-process communication is involved.
Mitigation strategies primarily involve upgrading to version 8.9.8 or later where this issue has been resolved by developers adding appropriate null checks before dereferencing the sessionInfo pointer. For environments unable to upgrade immediately, restricting which processes can send messages to Notepad++ via Windows integrity levels and desktop isolation can reduce exposure. Additionally, users should configure automatic backup features within Notepad++ settings to mitigate data loss in case of unexpected crashes caused by other vulnerabilities or system instability. Regular patching cycles are essential to address such defects that compromise software stability and user productivity.