Notepad++ CVE-2026-48770

Exploitation requires a process running within the same interactive Windows desktop session as the target Notepad++ instance (AV:L). Low operating system privileges are sufficient - no administrator or Notepad++ process privileges are needed (PR:L). User interaction is required in the sense that the target Notepad++ instance must be running and its message queue must be processing; the attack does not require the user to click or open a file (UI:R reflects the running-application dependency, not a phishing step). Non-default conditions that LIMIT exploitation: the attacker must already have arbitrary code execution on the endpoint in the same session, ruling out remote or cross-session attack paths; Windows UIPI will block the message if the sender runs at a lower integrity level than Notepad++, which is the default for processes launched by standard users from a Medium integrity context - both attacker and target typically run at Medium integrity, so UIPI does not provide protection in the default deployment. The vulnerability is not exploitable over a network and cannot be triggered by a file opened in Notepad++.

The CVSS 3.1 base score of 5.0 (Medium) reflects a local attack vector (AV:L), low attack complexity (AC:L), low privilege requirement (PR:L), and required user interaction (UI:R), with impact limited to availability (A:H). Real-world risk is constrained: the attacker must already have code execution on the same interactive Windows desktop session as the Notepad++ user, significantly reducing the attack surface compared to network-reachable vulnerabilities. There is no CISA KEV listing and no confirmed public exploit code, meaning exploitation probability from opportunistic actors is low. EPSS data was not provided in the intelligence feed, so probabilistic exploitation likelihood cannot be quantified. The 'Information Disclosure' tag in the metadata is inconsistent with the CVSS C:N rating; out-of-bounds reads can theoretically expose adjacent memory, but the CVSS and the nature of the Windows structured exception handler catch suggest the primary observable outcome is process crash rather than data leakage - defenders should not treat this as a confirmed data-exfiltration vector. The fix (exception wrapping) is a partial mitigation in debug builds only; release builds silently swallow the exception, which resolves the crash but does not enforce cbData bounds - this is worth tracking if a more complete bounds check is not subsequently added. Overall, this is a low-to-moderate priority patch for most environments: apply during the next standard update cycle rather than as an emergency.

An attacker with a low-privileged process running in the same interactive Windows desktop session as Notepad++ enumerates top-level windows to locate the Notepad++ main window handle, then calls SendMessage with WM_COPYDATA, setting dwData to COPYDATA_FULL_CMDLINE and providing an lpData buffer that is not NUL-terminated within the cbData-specified length. Notepad++'s WM_COPYDATA handler reads the wchar_t* past the buffer boundary, triggering an access violation and crashing the editor, causing loss of any unsaved work. No public POC code has been identified at time of analysis, but the attack is straightforward to implement by any local process using standard Win32 API calls.