Notepad++ CVE-2026-86056

Requires LOCAL code execution: the attacker must already control a process running at the same or a higher Windows integrity level on the same interactive desktop session as the running Notepad++ instance, so it can send the NPPM_SAVESESSION window message with a null lParam to the Notepad++ window. No authentication over the network and no victim user interaction is needed once such a local process exists, but the prerequisite of an equal-or-higher-integrity local process on the same desktop is a significant limiting factor. Impact is confined to crashing the editor (denial of service) and loss of any unsaved documents - there is no confidentiality or integrity compromise. Only versions prior to 8.9.8 are affected; the platform is Windows exclusively.

This is a genuinely low-priority, low-severity issue despite being a memory-safety bug. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5 MEDIUM) is availability-only - no confidentiality or integrity impact - and requires LOCAL access (AV:L) plus an already-running process at the same or higher Windows integrity level on the same interactive desktop (PR:L). The SSVC decision framework aligns: Exploitation=poc (proof-of-concept exists, consistent with a trivially-crafted window message and the visible one-line patch), Automatable=no, and Technical Impact=partial - three signals that all point to a nuisance-grade local DoS rather than a remotely-exploitable priority. There is no CISA KEV listing and no EPSS score was provided; per the precision rules, absence of these is not an exploitation signal. The key limiting factor to stress: an attacker who can run a process at equal-or-higher integrity on the victim's desktop already possesses substantial local capability, so crashing Notepad++ (and losing unsaved documents) adds little to their position. Bottom line: real-world risk is low; this is a correctly-scored MEDIUM that does not warrant emergency patching, only routine update to 8.9.8.

A malicious or compromised process running at the same or higher integrity level on the victim's interactive desktop sends the Notepad++ window an NPPM_SAVESESSION message with a null lParam. The handler blindly casts lParam to a sessionInfo pointer and dereferences it, immediately crashing the editor and discarding any unsaved work. A proof-of-concept is indicated by the SSVC 'poc' status, but no active exploitation (KEV) is reported.