EUVD-2026-39908Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Local IPC attack requires same-session process; low privileges suffice; impact is availability-only crash with no confirmed data disclosure.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, a local process in the same interactive Windows session can send a malformed WM_COPYDATA message to Notepad++ using the COPYDATA_FULL_CMDLINE path. The handler appears to process COPYDATASTRUCT.lpData as an unbounded NUL-terminated wchar_t* instead of enforcing COPYDATASTRUCT.cbData. This vulnerability is fixed in 8.9.6.1.
AnalysisAI
Notepad++ versions prior to 8.9.6.1 can be crashed by any local process sharing the same interactive Windows session via a malformed WM_COPYDATA message. The COPYDATA_FULL_CMDLINE handler in NppBigSwitch.cpp dereferences COPYDATASTRUCT.lpData as an unbounded NUL-terminated wchar_t* without validating against the COPYDATASTRUCT.cbData length field, enabling an out-of-bounds read that results in process termination. No active exploitation has been confirmed (no CISA KEV listing, no public POC), and the fix is available in the vendor-released patch 8.9.6.1.
Technical ContextAI
WM_COPYDATA is a Windows inter-process communication mechanism that allows processes to share read-only data blocks across session boundaries via the COPYDATASTRUCT structure, which carries a pointer (lpData), a byte count (cbData), and a type identifier (dwData). The vulnerable code path, identified in PowerEditor/src/NppBigSwitch.cpp, handles the COPYDATA_FULL_CMDLINE case by casting lpData directly to wchar_t* and passing it to setCmdLineString() without first confirming that the buffer contains a valid NUL terminator within the cbData-specified bounds. CWE-125 (Out-of-bounds Read) is the root cause: if a malicious sender provides lpData pointing to a buffer without a NUL terminator within cbData bytes, the string-processing logic will read past the allocation boundary. On Windows this manifests as a structured exception (access violation), which the pre-patch code did not catch, resulting in an unhandled crash. CPE cpe:2.3:a:notepad-plus-plus:notepad-plus-plus:*:*:*:*:*:*:*:* covers all prior releases. The tag 'Buffer Overflow' in the intelligence metadata is a misnomer; the actual class is out-of-bounds read, consistent with CWE-125 and the CVSS C:N/I:N/A:H impact profile.
RemediationAI
Upgrade Notepad++ to version 8.9.6.1, which is the vendor-released patch confirmed by GitHub Security Advisory GHSA-r39g-3mcw-xcg2 and commit f20a0888a92ce557a339b833cd9d9d8e97dc797d. The fix wraps the lpData dereference in a structured exception handler, preventing unhandled crashes in both the COPYDATA_FULL_CMDLINE and COPYDATA_FILENAMESW paths. If an immediate upgrade is not possible, a compensating control is to restrict which processes can post messages to Notepad++ windows using Windows UI Privilege Isolation (UIPI) by running Notepad++ at a higher integrity level (e.g., Medium-High), so lower-integrity processes cannot send WM_COPYDATA to it; note this breaks legitimate IPC from same-session tools that use the Notepad++ command-line pass-through feature. Enterprise deployments managed via AppLocker or similar can also restrict which binaries are permitted to run in the same session, reducing the pool of potential sender processes.
More in Notepad Plus Plus
View allNotepad++ versions prior to 8.8.9 contain an update integrity verification vulnerability (CVE-2025-15556) when using the
Local code execution in Notepad++ before 8.9.6.1 occurs because the <GUIConfig name="commandLineInterpreter"> value in c
An Untrusted search path vulnerability in notepad++ 6.5 allows local users to gain escalated privileges through the msim
Notepad++ is a free and open-source source code editor. Rated high severity (CVSS 7.8), this vulnerability is no authent
Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerable dll (Ux
SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode ch
Notepad++ versions before 8.9.2 allow local code execution through an unsafe search path vulnerability that permits atta
Notepad++ v8.4.1 was discovered to contain a stack overflow via the component Finder::add(). Rated medium severity (CVSS
Notepad++ is a free and open-source source code editor. Rated medium severity (CVSS 5.5), this vulnerability is no authe
Notepad++ is a free and open-source source code editor. Rated medium severity (CVSS 5.5), this vulnerability is no authe
Notepad++ is a free and open-source source code editor. Rated medium severity (CVSS 5.5), this vulnerability is no authe
Local OS command injection in Notepad++ before 8.9.6.1 lets an attacker who can write to a user's shortcuts.xml inject a
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today