CVE-2026-86056: Notepad++ null pointer dereference in NPPM_SAVESESSION handler

Executive brief

Notepad++ is a free text editor used by developers for writing and editing source code. A local attacker with the same or higher Windows privilege level can crash Notepad++ and cause loss of unsaved documents by sending a specially crafted message. This denial of service attack requires the attacker to be on the same desktop but can immediately terminate the application without user interaction.

Technical details

The NPPM_SAVESESSION message handler in PowerEditor/src/NppBigSwitch.cpp casts lParam to a sessionInfo pointer and dereferences its members without null-pointer validation. An attacker with local access and same or higher Windows integrity level can send NPPM_SAVESESSION with null lParam, triggering an immediate crash. The fix adds a null check before dereferencing the pointer.

Affected products

• Notepad++ Notepad++ before 8.9.8

Timeline

• 2026-09-22: disclosed
• 2026-08-23: patched: version 8.9.8 released

References

• https://github.com/notepad-plus-plus/notepad-plus-plus/commit/8b33f52e7aa488b1222d3cfce5903a38dd63101f
• https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.8