CVE-2026-48770 Notepad++ WM_COPYDATA COPYDATA_FULL_CMDLINE local DoS crash

What is CVE-2026-48770?

CVE-2026-48770 is a medium-severity vulnerability in notepad-plus-plus, published on 26 Jun 2026.

Official description

Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, a local process in the same interactive Windows session can send a malformed WM_COPYDATA message to Notepad++ using the COPYDATA_FULL_CMDLINE path. The handler appears to process COPYDATASTRUCT.lpData as an unbounded NUL-terminated wchar_t* instead of enforcing COPYDATASTRUCT.cbData. This vulnerability is fixed in 8.9.6.1.

Weakness: CWE-125

Which versions are affected by CVE-2026-48770?

It affects 1 product.

Products include Notepad-Plus-Plus Notepad\+\+.

How do I fix CVE-2026-48770?

No fix has been published for CVE-2026-48770 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-48770 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-48770 exists.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in notepad-plus-plus

• CVE-2025-15556 Notepad++ Download of Code Without Integrity Check Exploited High 7.7
• CVE-2026-48778 Notepad++: Arbitrary Code Execution via config.xml commandLineInterpreter High 7.8
• CVE-2026-48800 Notepad++: Arbitrary Code Execution via shortcuts.xml UserCommand Injection High 7.8
• CVE-2026-52884 Notepad++: CVE-2026-48800 Bypass High 7.8
• CVE-2023-47452 Privilege escalation in n/a High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r39g-3mcw-xcg2.