# CVE-2026-86056: Notepad++ null pointer dereference in NPPM_SAVESESSION handler

Source: https://junglewise.ai/threats/cve-2026-86056-notepad-is-a-free-and-open-source-source-code-editor-prior-to-8-9  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-22. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86056 · Severity: medium · CVSS 5.5 · Published 2026-09-22

Notepad++ is a free text editor used by developers for writing and editing source code. A local attacker with the same or higher Windows privilege level can crash Notepad++ and cause loss of unsaved documents by sending a specially crafted message. This denial of service attack requires the attacker to be on the same desktop but can immediately terminate the application without user interaction.

## Quick answers

**Is CVE-2026-86056 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86056 being exploited in the wild.

**How severe is CVE-2026-86056?** Medium severity, with a CVSS score of 5.5, published 22 September 2026.

**Which products and versions are affected?** Notepad++ Notepad++ before 8.9.8.

**Is there a fix for CVE-2026-86056?** A patch was published on 2026-08-23: version 8.9.8 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86056 attacked?** It is attacked with local access or from the adjacent network, in a web application.

**Am I affected by CVE-2026-86056?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The NPPM_SAVESESSION message handler in PowerEditor/src/NppBigSwitch.cpp casts lParam to a sessionInfo pointer and dereferences its members without null-pointer validation. An attacker with local access and same or higher Windows integrity level can send NPPM_SAVESESSION with null lParam, triggering an immediate crash. The fix adds a null check before dereferencing the pointer.

## Affected products

- Notepad++ Notepad++ before 8.9.8

## Timeline

- 2026-09-22: disclosed
- 2026-08-23: patched: version 8.9.8 released

## References

- [https://github.com/notepad-plus-plus/notepad-plus-plus/commit/8b33f52e7aa488b1222d3cfce5903a38dd63101f](https://github.com/notepad-plus-plus/notepad-plus-plus/commit/8b33f52e7aa488b1222d3cfce5903a38dd63101f)
- [https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.8](https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.8)