Is CVE-2026-86056 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86056 being exploited in the wild.

How severe is CVE-2026-86056?

Medium severity, with a CVSS score of 5.5, published 22 September 2026.

Which products and versions are affected?

Notepad++ Notepad++ before 8.9.8.

Is there a fix for CVE-2026-86056?

A patch was published on 2026-08-23: version 8.9.8 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86056 attacked?

It is attacked with local access or from the adjacent network, in a web application.

Am I affected by CVE-2026-86056?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86056: Notepad++ null pointer dereference in NPPM_SAVESESSION handler

CVE-2026-86056 · Severity: medium · CVSS 5.5 · Published 2026-09-22

Notepad++ is a free text editor used by developers for writing and editing source code. A local attacker with the same or higher Windows privilege level can crash Notepad++ and cause loss of unsaved documents by sending a specially crafted message. This denial of service attack requires the attacker to be on the same desktop but can immediately terminate the application without user interaction.

Quick answers

Is CVE-2026-86056 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86056 being exploited in the wild.
How severe is CVE-2026-86056?: Medium severity, with a CVSS score of 5.5, published 22 September 2026.
Which products and versions are affected?: Notepad++ Notepad++ before 8.9.8.
Is there a fix for CVE-2026-86056?: A patch was published on 2026-08-23: version 8.9.8 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86056 attacked?: It is attacked with local access or from the adjacent network, in a web application.
Am I affected by CVE-2026-86056?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The NPPM_SAVESESSION message handler in PowerEditor/src/NppBigSwitch.cpp casts lParam to a sessionInfo pointer and dereferences its members without null-pointer validation. An attacker with local access and same or higher Windows integrity level can send NPPM_SAVESESSION with null lParam, triggering an immediate crash. The fix adds a null check before dereferencing the pointer.

Affected products

Notepad++ Notepad++ before 8.9.8

Timeline

2026-09-22: disclosed
2026-08-23: patched: version 8.9.8 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.