Denial of Service Vulnerability in Notepad++ by Notepad++ Software
CVE-2026-86056

5.5MEDIUM

Key Information:

Vendor

Notepad-plus-plus

Status
Notepad-plus-plus
Vendor
CVE Published:
22 September 2026

What is CVE-2026-86056?

Notepad++ versions prior to 8.9.8 are susceptible to a denial of service due to a flaw in the NPPM_SAVESESSION handler. This vulnerability allows an attacker with appropriate permissions to send a malformed message, leading to the dereferencing of a null pointer. This may cause the application to terminate abruptly and result in the loss of unsaved documents. Users should upgrade to version 8.9.8 to mitigate this risk. More details can be found at the official GitHub advisory and the release notes.

Affected Version(s)

notepad-plus-plus < 8.9.8

References

https://github.com/notepad-plus-plus/notepad-plus-plus/se...
x_refsource_CONFIRM
https://github.com/notepad-plus-plus/notepad-plus-plus/co...
x_refsource_MISC
https://github.com/notepad-plus-plus/notepad-plus-plus/re...
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.