CVE-2026-86056 Notepad++: Null pointer dereference in NPPM_SAVESESSION message handler causes crash (DoS)
A local attacker can crash Notepad++ by sending a crafted message with null parameters, causing denial of service and loss of unsaved work.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-86056?
CVE-2026-86056 is a medium-severity vulnerability in notepad-plus-plus, published on 22 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the NPPM_SAVESESSION handler in PowerEditor/src/NppBigSwitch.cpp converts lParam to a sessionInfo pointer and dereferences its nbFile, files, and sessionFilePathName members without checking for null. A process running at the same or a higher Windows integrity level on the same desktop can send NPPM_SAVESESSION with a null lParam, immediately terminating Notepad++ and causing denial of service and loss of unsaved documents. This issue is fixed in version 8.9.8.
Weakness: CWE-476
Which versions are affected by CVE-2026-86056?
How do I fix CVE-2026-86056?
No fix has been published for CVE-2026-86056 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-86056 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-86056 exists.
Sources
Also known as GHSA-j85c-6wc9-p98p.