CVE-2026-86056: Notepad++ NPPM_SAVESESSION DOS Vulnerability

CVE-2026-86056 Overview

CVE-2026-86056 is a null pointer dereference vulnerability [CWE-476] in Notepad++, the open-source source code editor for Windows. The flaw resides in the NPPM_SAVESESSION message handler within PowerEditor/src/NppBigSwitch.cpp. The handler casts the lParam value to a sessionInfo pointer and dereferences its nbFile, files, and sessionFilePathName members without validating that the pointer is non-null. A local process running at the same or higher Windows integrity level on the same desktop can send a crafted NPPM_SAVESESSION message with a null lParam, terminating Notepad++ immediately. The issue affects versions prior to 8.9.8 and is fixed in 8.9.8.

Critical Impact
Local attackers on the same desktop can crash Notepad++ on demand, causing denial of service and loss of unsaved documents.

Affected Products

Notepad++ versions prior to 8.9.8
PowerEditor/src/NppBigSwitch.cppNPPM_SAVESESSION handler
Windows desktop installations of Notepad++

Discovery Timeline

2026-09-22 - CVE-2026-86056 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-86056

Vulnerability Analysis

Notepad++ exposes application functionality through Windows messages defined in its plugin interface. The NPPM_SAVESESSION message instructs the editor to persist the current session data to a file specified by the caller. The handler expects lParam to point to a valid sessionInfo structure supplied by the sender. Prior to version 8.9.8, the handler performed no validation before dereferencing that pointer. Sending the message with lParam set to null triggers an access violation and crashes the process. Users lose any unsaved document state at the moment of the crash.

Root Cause

The root cause is missing input validation on an inter-process message parameter. The NPPM_SAVESESSION case in NppBigSwitch.cpp reinterprets lParam as a sessionInfo* and immediately reads three member fields. Because Windows messages can originate from any process sharing the desktop, the handler must treat lParam as untrusted input.

Attack Vector

Exploitation requires local access on the same interactive desktop as the Notepad++ process. An attacker running at the same or higher Windows integrity level uses FindWindow or an equivalent enumeration API to obtain the Notepad++ window handle, then calls SendMessage or PostMessage with NPPM_SAVESESSION and a null lParam. No user interaction is required, and the crash occurs deterministically on the first message.

cpp

// Security patch in PowerEditor/src/NppBigSwitch.cpp
case NPPM_SAVESESSION:
{
    if (!lParam) return FALSE;
    sessionInfo *pSi = reinterpret_cast<sessionInfo *>(lParam);
    return (LRESULT)fileSaveSession(pSi->nbFile, pSi->files, pSi->sessionFilePathName);
}

Source: GitHub Commit 8b33f52. The patch adds a null check on lParam before the reinterpret cast, causing the handler to return FALSE when the parameter is invalid.

Detection Methods for CVE-2026-86056

Indicators of Compromise

Unexpected notepad++.exe process termination with Windows Error Reporting entries citing an access violation at address 0x0 in the NPPM_SAVESESSION code path.
Application crash events in the Windows Application event log referencing notepad++.exe and faulting module notepad++.exe.
User reports of Notepad++ closing without warning and loss of unsaved buffer content.

Detection Strategies

Monitor for local processes enumerating Notepad++ top-level windows via FindWindowW or EnumWindows followed by SendMessage or PostMessage calls targeting the Notepad++ window class.
Correlate Notepad++ crash telemetry with the presence of newly launched, unsigned, or low-reputation processes on the same interactive session.
Track version inventory to identify endpoints still running Notepad++ builds earlier than 8.9.8.

Monitoring Recommendations

Enable Windows Error Reporting collection and forward .wer telemetry to a centralized log platform for review.
Deploy endpoint telemetry that captures cross-process window message activity and correlates it with process ancestry.
Alert on repeated Notepad++ crashes on the same host within a short interval, which may indicate active abuse.

How to Mitigate CVE-2026-86056

Immediate Actions Required

Upgrade all Notepad++ installations to version 8.9.8 or later using the official installer from the Notepad++ v8.9.8 release notes.
Inventory endpoints for outdated Notepad++ builds and prioritize systems used by developers or administrators.
Advise users to save work frequently until patching is complete, since exploitation destroys unsaved buffers.

Patch Information

The fix is committed in GitHub commit 8b33f52 and shipped in the Notepad++ v8.9.8 release. Additional context is available in the GitHub Security Advisory GHSA-j85c-6wc9-p98p.

Workarounds

Restrict interactive desktop access to trusted users, since exploitation requires a local process on the same desktop.
Run Notepad++ under a standard user account so that peer processes cannot elevate to a higher integrity level and send messages.
Avoid executing untrusted binaries in the same session while Notepad++ holds unsaved work.

bash

# Verify installed Notepad++ version on Windows endpoints
powershell -Command "(Get-Item 'C:\Program Files\Notepad++\notepad++.exe').VersionInfo.ProductVersion"