CVE-2026-86056 json
Notepad++: Null pointer dereference in NPPM_SAVESESSION message handler causes crash (DoS)
published 2mo ago modified last mo. also EUVD-2026-84574 , GHSA-j85c-6wc9-p98p
Unreviewed: the maintainers' own advisory
Published by the maintainers on their GitHub repository notepad-plus-plus/notepad-plus-plus. GitHub has not reviewed it into the GitHub Advisory Database, so the affected packages and versions are the maintainers' word. Read the full advisory on GitHub.
- cvss
- 5.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 5%
- public exploits
- 0
- none known
Summary
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the NPPM_SAVESESSION handler in PowerEditor/src/NppBigSwitch.cpp converts lParam to a sessionInfo pointer and dereferences its nbFile, files, and sessionFilePathName members without checking for null. A process running at the same or a higher Windows integrity level on the same desktop can send NPPM_SAVESESSION with a null lParam, immediately terminating Notepad++ and causing denial of service and loss of unsaved documents. This issue is fixed in version 8.9.8.
Patch / fix
- notepad-plus-plus notepad++ 8.9.8
Is CVE-2026-86056 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- last mo.
Exploit prediction
0.16% chance of exploitation in the next 30 days, higher than 5% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Affected products
- notepad-plus-plus notepad-plus-plus
Classification
- Weakness
-
- CWE-476 NULL Pointer Dereference
References
- github.com /notepad-plus-plus/notepad-plus-plus/commit/8b33f52e7aa488b1222d3cfce5903a38dd63101f
-
github.com
/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-j85c-6wc9-p98p
advisory
- github.com /notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.8
- notepad-plus-plus.org /news/v898-released
Sources
- CVE List CVE-2026-86056
- NVD CVE-2026-86056
- Maintainer advisory GHSA-j85c-6wc9-p98p
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of notepad-plus-plus/notepad-plus-plus published their own advisory on GitHub. Reviewed sources take precedence over it.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.