CVE-2026-48770: 
Notepad++ vulnerability analysis and mitigation

CVE-2026-48770 is a local denial-of-service vulnerability in Notepad++ caused by improper handling of malformed WM_COPYDATA messages via the COPYDATA_FULL_CMDLINE path. It affects all Notepad++ versions prior to 8.9.6.1 and was disclosed on May 26, 2026, with a patch released in version 8.9.6.1. The vulnerability carries a CVSS v3.1 base score of 5.0 (Medium) (GitHub Advisory).

The root cause is an out-of-bounds read (CWE-125) in Notepad++'s WM_COPYDATA message handler within NppBigSwitch.cpp. When processing the COPYDATA_FULL_CMDLINE message type, the handler casts COPYDATASTRUCT.lpData directly to an unbounded wchar_t* and reads it as a NUL-terminated string without validating or enforcing the size limit specified by COPYDATASTRUCT.cbData. A local attacker in the same interactive Windows session can send a crafted WM_COPYDATA message with dwData=3 (COPYDATA_FULL_CMDLINE), cbData=8192, and lpData pointing to 4096 WCHARs without a NUL terminator, causing the application to read beyond the intended buffer boundary and crash. The fix wraps the handler in a try/catch block and adds bounded validation of the input (GitHub Advisory, Fix Commit).

Successful exploitation results in a reliable crash of the Notepad++ process, causing a local denial of service. Windows records the crash as an APPCRASH event for notepad++.exe with exception code 0xc0000005 (access violation) or 0xc000041d, logged under Windows Event IDs 1000 and 1001. There is no confidentiality or integrity impact; the vulnerability is limited to availability of the Notepad++ application for the targeted user session (GitHub Advisory).

1. Prerequisite: Obtain low-privileged code execution in the same interactive Windows session as the Notepad++ user (e.g., via a running process or script in the same desktop session).
2. Identify target window: Use Windows API calls (e.g., FindWindow or EnumWindows) to locate the Notepad++ main window handle (HWND) by searching for the window class or title associated with notepad++.exe.
3. Craft malformed WM_COPYDATA message: Construct a COPYDATASTRUCT with dwData = 3 (COPYDATA_FULL_CMDLINE), cbData = 8192, and lpData pointing to a buffer of 4096 WCHARs with no NUL terminator.
4. Send the message: Use SendMessageTimeout or SendMessage to deliver the malformed WM_COPYDATA message to the identified Notepad++ window handle.
5. Observe crash: The Notepad++ process reads past the end of the buffer, triggering an access violation (exception code 0xc0000005). Windows records APPCRASH events (Event IDs 1000 and 1001) confirming the denial of service (GitHub Advisory, PoC Repository).

• Logs: Windows Event Log entries with Event ID 1000 and 1001 (Application Error / Windows Error Reporting) for notepad++.exe; APPCRASH fault module with exception code 0xc0000005 or 0xc000041d at fault offset 0x0000000000003313.
• Process: Unexpected termination of notepad++.exe without user-initiated close action; WerFault.exe spawning as a child process following the crash.
• Network: No network-based IOCs — exploitation is entirely local.
• File System: Presence of poc_CVE-2026-48770.py or similar PowerShell scripts in user-accessible directories; Windows Error Reporting dump files (.dmp) in %LOCALAPPDATA%\CrashDumps or %TEMP% related to notepad++.exe (GitHub Advisory).

Update Notepad++ to version 8.9.6.1 or later, which wraps the WM_COPYDATA handler in bounded validation and exception handling to reject malformed unterminated input (Fix Commit, Notepad++ v8.9.6.1). Subsequent releases (8.9.6.2 and 8.9.6.4) are also available and recommended. As a general hardening measure, apply the principle of least privilege to restrict which local processes can interact with Notepad++ in the same interactive session, and avoid running untrusted processes in the same Windows desktop session as Notepad++.

The vulnerability received moderate media coverage given its association with related, higher-severity Notepad++ CVEs (CVE-2026-48778, CVE-2026-48800) disclosed simultaneously. Coverage appeared in Heise, CyberSecurityNews, GBHackers, CSO Online, and The Hacker News weekly recap (Heise, The Hacker News). Community discussion on Reddit's CVEWatch listed it among trending CVEs. The Notepad++ maintainer (donho) published the advisory and patch promptly, and credited researchers Enrique de Clerck, Leonardo Gutiérrez, and Daniel Cifuentes for responsible disclosure (GitHub Advisory).