CVE-2026-48770: Notepad++ Buffer Overflow Vulnerability

CVE-2026-48770 Overview

CVE-2026-48770 is an out-of-bounds read vulnerability in Notepad++ versions prior to 8.9.6.1. The flaw resides in the WM_COPYDATA message handler that processes the COPYDATA_FULL_CMDLINE path. The handler treats COPYDATASTRUCT.lpData as an unbounded NUL-terminated wchar_t* string rather than enforcing the COPYDATASTRUCT.cbData length field. A local process running in the same interactive Windows session can send a malformed message that triggers a crash. The maintainers patched the issue in version 8.9.6.1. A public proof-of-concept exists in the atiilla/Notepad-8.9.6-PoC GitHub repository.

Critical Impact
A local attacker in the same interactive Windows session can crash Notepad++ by sending a malformed WM_COPYDATA message, causing loss of unsaved work and application availability.

Affected Products

Notepad++ versions prior to 8.9.6.1
All Windows platforms running vulnerable Notepad++ builds
Systems where multiple interactive users share a Windows session context

Discovery Timeline

2026-06-26 - CVE-2026-48770 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-48770

Vulnerability Analysis

The vulnerability is classified as an out-of-bounds read [CWE-125]. Notepad++ registers a top-level window that receives inter-process messages via the standard Windows WM_COPYDATA mechanism. When another process in the same interactive session sends a WM_COPYDATA message with dwData set to COPYDATA_FULL_CMDLINE, the receiver reads pCopyData->lpData and passes it directly to nppParam.setCmdLineString() as a wide-character string. The handler never validates that the buffer contains a terminating NUL within the bounds described by pCopyData->cbData. A crafted message with an unterminated buffer causes the string routines to read past the allocated memory until they hit a NUL or an unmapped page, producing an access violation and crashing the process.

Root Cause

The root cause is missing input validation on the COPYDATASTRUCT fields. Windows requires receivers to trust neither lpData nor cbData from untrusted senders. The Notepad++ handler enforced neither, ignoring cbData entirely and dereferencing lpData as a NUL-terminated string.

Attack Vector

Exploitation requires local access with the ability to run code in the same interactive Windows session as the target Notepad++ instance. The attacker locates the Notepad++ window handle, then calls SendMessage with WM_COPYDATA and a crafted COPYDATASTRUCT. No elevated privileges are needed on the attacker side. The published proof-of-concept uses Python ctypes and a PowerShell variant to reproduce the crash.

cpp

            {
                case COPYDATA_FULL_CMDLINE:
                {
-                   nppParam.setCmdLineString(static_cast<wchar_t*>(pCopyData->lpData));
+                   try {
+                       wchar_t* str2set = static_cast<wchar_t*>(pCopyData->lpData);
+                       nppParam.setCmdLineString(str2set);
+                   }
+                   catch (...)
+                   {
+#if !defined(NDEBUG)
+                       printStr(L"COPYDATA_FULL_CMDLINE: invalid string pointer.");
+#endif
+                   }
                    break;
                }

Source: Notepad++ security patch commit f20a0888

Detection Methods for CVE-2026-48770

Indicators of Compromise

Unexpected crashes of notepad++.exe with access violation exception codes (0xC0000005) in the Windows Application event log.
Windows Error Reporting (WER) dumps for Notepad++ showing faults in string-handling routines called from NppBigSwitch.cpp.
Presence of poc_CVE-2026-48770.py or poc_CVE-2026-48770.ps1 artifacts on disk from the public PoC repository.

Detection Strategies

Monitor process creation events where a non-Notepad++ process invokes SendMessage or PostMessage targeting the Notepad++ window class Notepad++.
Alert on repeated crashes of notepad++.exe on the same host within a short interval, which suggests active exploitation attempts.
Hunt for PowerShell or Python scripts referencing WM_COPYDATA (0x004A) and FindWindow calls against Notepad++.

Monitoring Recommendations

Ingest Windows Application and Reliability logs into a central SIEM and build rules for notepad++.exe faulting modules.
Track installed Notepad++ versions across the estate through software inventory to identify hosts still running builds prior to 8.9.6.1.
Correlate local process ancestry with Notepad++ crash events to identify the sending process.

How to Mitigate CVE-2026-48770

Immediate Actions Required

Upgrade all Notepad++ installations to version 8.9.6.1 or later, which contains the fix in commit f20a0888.
Inventory endpoints running Notepad++ and prioritize patching on multi-user or shared workstations first.
Remove or restrict Notepad++ on systems where multiple untrusted users share an interactive session.

Patch Information

The vulnerability is fixed in Notepad++ 8.9.6.1. The fix wraps the setCmdLineString call in a try/catch block to contain access violations from malformed lpData pointers. Refer to the GitHub Security Advisory GHSA-r39g-3mcw-xcg2 and the upstream commit for details.

Workarounds

Close Notepad++ when not in active use to reduce the window during which a malicious local process can send crafted messages.
Enforce least-privilege user accounts and application allow-listing to prevent unauthorized local binaries from executing.
Save work frequently and enable Notepad++ backup-on-save to reduce data loss impact from unexpected crashes.

bash

# Verify installed Notepad++ version on Windows via PowerShell
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Notepad++" |
    Select-Object DisplayName, DisplayVersion

# Silent upgrade using the official installer
Start-Process -FilePath ".\npp.8.9.6.1.Installer.x64.exe" -ArgumentList "/S" -Wait