CVE-2026-86056
Received Received - Intake

Denial of Service in Notepad++ via Null Pointer Dereference

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the NPPM_SAVESESSION handler in PowerEditor/src/NppBigSwitch.cpp converts lParam to a sessionInfo pointer and dereferences its nbFile, files, and sessionFilePathName members without checking for null. A process running at the same or a higher Windows integrity level on the same desktop can send NPPM_SAVESESSION with a null lParam, immediately terminating Notepad++ and causing denial of service and loss of unsaved documents. This issue is fixed in version 8.9.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-86056
EUVD
EUVD-2026-84574

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
notepad++ notepad++ 8.9.8
notepad++ notepad++ to 8.9.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a null pointer dereference vulnerability in Notepad++ versions before 8.9.8. The NPPM_SAVESESSION message handler does not validate the lParam parameter before using it as a pointer to a sessionInfo struct. When lParam is null, the application crashes due to an access violation, causing denial of service and loss of unsaved documents.

Detection Guidance

This vulnerability can be detected by checking the Notepad++ version installed on your system. If you are running version 8.9.7.0 or earlier, your system is vulnerable. You can check the version by opening Notepad++ and going to Help > About Notepad++.

Impact Analysis

An attacker with local access and the same or higher Windows integrity level can exploit this to crash Notepad++, losing all unsaved work. No user interaction is required, and the attack is straightforward to execute via a proof-of-concept script.

Mitigation Strategies

Immediately update Notepad++ to version 8.9.8 or later to patch the vulnerability. If updating is not possible, avoid using Notepad++ until the update is applied, as the vulnerability can be triggered by a local process with the same or higher integrity level.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86056. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart