CVE-2026-86056: Notepad++: Null pointer dereference in NPPM_SAVESESSION message handler causes crash (DoS)
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the NPPMSAVESESSION handler in PowerEditor/src/NppBigSwitch.cpp converts lParam to a sessionInfo pointer and dereferences its nbFile, files, and sessionFilePathName members without checking for null. A process running at the same or a higher Windows integrity level on the same desktop can send NPPMSAVESESSION with a null lParam, immediately terminating Notepad++ and causing denial of service and loss of unsaved documents. This issue is fixed in version 8.9.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Notepad++to a version that resolves this vulnerability.Fixed in 8.9.8
Event History
Frequently Asked Questions
Which systems are exposed to this denial-of-service issue?
Notepad++ versions prior to 8.9.8 are affected when an attacker can run a process on the same Windows desktop at the same or higher integrity level as the Notepad++ process. The impact is limited to terminating Notepad++; unsaved documents may be lost.
What does an attacker need to exploit the issue?
The attacker needs the ability to send a Windows message to the Notepad++ process from a local process running at an eligible integrity level. Exploitation consists of sending the NPPM_SAVESESSION message with a null lParam value.
How can the issue be remediated?
Upgrade Notepad++ to version 8.9.8, which fixes the null-pointer handling in the NPPM_SAVESESSION message handler.