CVE-2026-48770: Notepad++ Local Denial of Service via Malformed WM_COPYDATA Message

Technical summary

The vulnerability exists in Notepad++'s handling of WM_COPYDATA window messages, specifically those using the COPYDATA_FULL_CMDLINE identifier. The vulnerable code treats the lpData field of the COPYDATASTRUCT as an unbounded NUL-terminated wide-character string without respecting the cbData field that specifies actual buffer length. An unprivileged local process can construct a malformed message where lpData points to invalid memory, causing Notepad++ to read beyond allocated boundaries and crash. This is classified as a read buffer over-read (CWE-125) resulting in denial of service.

Business impact

For organizations using Notepad++ as a development or scripting tool, this vulnerability can disrupt workflow by allowing other local processes to crash the editor without warning, potentially causing unsaved work loss and workflow interruption. The impact is localized to individual machines and does not affect data confidentiality or integrity directly. However, in shared development environments or multi-tenant systems, malicious users could weaponize this to degrade productivity or mask other suspicious activities during service disruption.

Affected systems

Notepad++ versions prior to 8.9.6.1 are affected. The vulnerability requires an attacker with local access to the same interactive Windows session, so it does not pose a risk to installations where Notepad++ is not used or where user isolation is strictly enforced. Both 32-bit and 64-bit installations are potentially affected if not updated.

Exploitability

Exploitation requires local access and ability to send inter-process messages, making this a low-barrier attack for any user already logged into the system. No user interaction beyond running Notepad++ is needed once a malicious process is present. Public exploit code is not required—triggering the crash is straightforward for an attacker with local code execution capabilities. However, the CVSS score of 5.0 reflects that this is a medium-severity issue limited to local denial of service, not remote or privilege-escalation scenarios.

Remediation

Update Notepad++ to version 8.9.6.1 or later immediately. The patch corrects the message handler to properly validate the cbData field and enforce buffer boundaries. No workarounds are available short of upgrading; users should disable Notepad++ or migrate to alternative editors if timely patching is not feasible in their environment.

Patch guidance

Navigate to the official Notepad++ download page or use the built-in auto-update feature (Help > Update Notepad++) to obtain version 8.9.6.1. Verify the installed version via Help > About Notepad++. Organizations managing multiple installations should push the update through standard software distribution mechanisms and verify completion before considering this vulnerability remediated. No additional configuration changes are required post-update.

Detection guidance

Monitor Windows Event Viewer for repeated application crashes (Event ID 1000, Application Error) involving notepad++.exe. Log inter-process message events if Windows Message Tracing is enabled. Endpoint Detection and Response (EDR) tools can flag suspicious WM_COPYDATA patterns or anomalous process communication. Verify current Notepad++ version across all systems using inventory or endpoint management tools; any version below 8.9.6.1 should be prioritized for patching.

Why prioritize this

Although this is a medium-severity vulnerability, it should be prioritized for quick patching because: (1) the fix is straightforward with no breaking changes, (2) the affected software is lightweight and updates are low-risk, and (3) local attackers in shared or multi-user environments may exploit this to disrupt development teams. Organizations using Notepad++ in secure or isolated environments can assign lower priority but should still plan updates within a standard maintenance cycle.

Risk score, explained

The CVSS 3.1 score of 5.0 (MEDIUM) reflects a local attack vector with low privileges required but straightforward execution. The severity is constrained because impact is limited to availability (denial of service) with no confidentiality or integrity compromise. The requirement for local access and active Notepad++ session prevents this from reaching HIGH severity despite simple exploitability.

Frequently asked questions