CVE-2026-48770 | Notepad++ is a free and open-source source code editor. Prio… | CVSS 5.0 MEDIUM

Description

Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, a local process in the same interactive Windows session can send a malformed WM_COPYDATA message to Notepad++ using the COPYDATA_FULL_CMDLINE path. The handler appears to process COPYDATASTRUCT.lpData as an unbounded NUL-terminated wchar_t* instead of enforcing COPYDATASTRUCT.cbData. This vulnerability is fixed in 8.9.6.1.

Metadata

CVE ID: CVE-2026-48770
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-05-22 19:39 UTC
Published: 2026-06-26 20:22 UTC
Last updated: 2026-06-26 20:22 UTC
Primary CWE: CWE-125
CWE-125: Out-of-bounds Read
Vendor / Product: notepad-plus-plus / notepad-plus-plus
Sources: cve.org · NVD

Severity & Metrics

5.0 MEDIUM CVSS 3.1

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

Affected products (1)

Vendor	Product	Platform	Versions
notepad-plus-plus	notepad-plus-plus	—	< 8.9.6.1

Weakness (CWE)

CWE	Source	Description
CWE-125	cna	CWE-125: Out-of-bounds Read

CVSS scores (1)

Score	Severity	Version	Source	Vector
5.0	MEDIUM	3.1	cna	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

References (2)

https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-r39g-3mcw-xcg2 https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-r39g-3mcw-xcg2
https://github.com/notepad-plus-plus/notepad-plus-plus/commit/f20a0888a92ce557a339b833cd9d9d8e97dc797d https://github.com/notepad-plus-plus/notepad-plus-plus/commit/f20a0888a92ce557a339b833cd9d9d8e97dc797d