Description
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the NPPM_SAVESESSION handler in PowerEditor/src/NppBigSwitch.cpp converts lParam to a sessionInfo pointer and dereferences its nbFile, files, and sessionFilePathName members without checking for null. A process running at the same or a higher Windows integrity level on the same desktop can send NPPM_SAVESESSION with a null lParam, immediately terminating Notepad++ and causing denial of service and loss of unsaved documents. This issue is fixed in version 8.9.8.
Published: 2026-09-22
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

A null pointer dereference in the Notepad++ NPPM_SAVESESSION handler causes the application to crash when the lParam parameter is null. This crash results in loss of unsaved documents and a denial of service to the user. The flaw is a classic null pointer dereference (CWE‑476) and does not lead to arbitrary code execution or privilege escalation.

Affected Systems

Notepad++ versions built for Windows prior to 8.9.8 are affected. The vulnerable code resides in PowerEditor/src/NppBigSwitch.cpp and handles the NPPM_SAVESESSION message. The issue exists in any installation of these earlier releases running on a Windows desktop where a local process can send Windows messages.

Risk and Exploitability

The CVSS score is 5.5, indicating moderate severity. No EPSS score is publicly available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a local process running at the same or higher integrity level on the same desktop that can send a Windows message to Notepad++. An attacker who succeeds can crash the application at will, causing data loss for active, unsaved work.

Generated by OpenCVE AI on September 22, 2026 at 18:37 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Notepad++ to version 8.9.8 or later, which contains the patch for the NPPM_SAVESESSION null pointer issue.
  • If an upgrade cannot be performed immediately, disable or remove any plugins or extensions that send NPPM_SAVESESSION messages, such as session‑saving utilities, to reduce exposure.
  • Configure monitoring for unexpected application crashes through event logs or user alerts so that potential exploitation attempts can be detected and investigated promptly.

Generated by OpenCVE AI on September 22, 2026 at 18:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 22 Sep 2026 19:15:00 +0000

Type Values Removed Values Added
First Time appeared Notepad-plus-plus
Notepad-plus-plus notepad++
Vendors & Products Notepad-plus-plus
Notepad-plus-plus notepad++

Tue, 22 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 22 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the NPPM_SAVESESSION handler in PowerEditor/src/NppBigSwitch.cpp converts lParam to a sessionInfo pointer and dereferences its nbFile, files, and sessionFilePathName members without checking for null. A process running at the same or a higher Windows integrity level on the same desktop can send NPPM_SAVESESSION with a null lParam, immediately terminating Notepad++ and causing denial of service and loss of unsaved documents. This issue is fixed in version 8.9.8.
Title Notepad++: Null pointer dereference in NPPM_SAVESESSION message handler causes crash (DoS)
Weaknesses CWE-476
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Notepad-plus-plus Notepad++
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-22T17:40:34.136Z

Reserved: 2026-09-04T19:29:21.059Z

Link: CVE-2026-86056

cve-icon Vulnrichment

Updated: 2026-09-22T17:40:26.332Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-22T18:17:24.087

Modified: 2026-09-23T18:28:25.093

Link: CVE-2026-86056

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T19:00:12Z

Weaknesses