Notepad++ is vulnerable to a local denial‑of‑service that can be triggered by a process in the same interactive Windows session. By sending a malformed WM_COPYDATA message through the COPYDATA_FULL_CMDLINE path, the handler interprets the data buffer as an unbounded NUL‑terminated wide string, ignoring the declared size in the COPYDATASTRUCT.cbData field. This buffer over‑read flaw, identified by CWE‑125, causes the application to crash when it attempts to process the malformed input.

All versions of Notepad++ released prior to 8.9.6.1 on Windows are affected. The issue was fixed in version 8.9.6.1 and later, so any installation that has not been updated to that revision remains vulnerable.

The CVSS score of 5.0 indicates a moderate severity. Because the exploit requires a local process able to send WM_COPYDATA in the same user session, remote attackers cannot leverage this flaw directly. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation is currently unlikely but the risk to any machine running an outdated version remains real.