Skip to content
OpenAdvisories
Medium · 5.0 Public exploit CVE-2026-48770 EUVD-2026-39908

Notepad++ WM_COPYDATA COPYDATA_FULL_CMDLINE local DoS crash

Published Jun 26, 2026 · Updated Jun 29, 2026 · Assigned by GitHub_M

Vendor: notepad-plus-plus Product: notepad-plus-plus

Description

Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, a local process in the same interactive Windows session can send a malformed WM_COPYDATA message to Notepad++ using the COPYDATA_FULL_CMDLINE path. The handler appears to process COPYDATASTRUCT.lpData as an unbounded NUL-terminated wchar_t* instead of enforcing COPYDATASTRUCT.cbData. This vulnerability is fixed in 8.9.6.1.

Affected products

VendorProductAffectedFixed
notepad-plus-plus notepad-plus-plus < 8.9.6.1 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • atiilla/Notepad-8.9.6-PoC ★ 6 · May 28, 2026

    Proof-of-concept scripts for three vulnerabilities in Notepad++ <= 8.9.6, patched in v8.9.6.1 (2026-05-26) CVE-2026-48770 / CVE-2026-48778 / CVE-2026-48800

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 1

References