CVE-2026-86056: Notepad-Plus-Plus

Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days.

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the NPPM_SAVESESSION handler in PowerEditor/src/NppBigSwitch.cpp converts lParam to a sessionInfo pointer and dereferences its nbFile, files, and sessionFilePathName members without checking for null. A process running at the same or a higher Windows integrity level on the same desktop can send NPPM_SAVESESSION with a null lParam, immediately terminating Notepad++ and causing denial of service and loss of unsaved documents. This issue is fixed in version 8.9.8.

Affected products

• Notepad-Plus-Plus Notepad-Plus-Plus: before 8.9.8 (fixed in 8.9.8)

Published 2026-09-22. Last modified 2026-09-23.