CVE-2026-86056 Notepad++: Null pointer dereference in NPPM_SAVESESSION message handler causes crash (DoS)

🗓️ 22 Sep 2026 17:14:13Reported by GitHub_MType

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the NPPM_SAVESESSION handler in PowerEditor/src/NppBigSwitch.cpp converts lParam to a sessionInfo pointer and dereferences its nbFile, files, and sessionFilePathName members w...

Reporter	Title	Published	Views	Family All 4
CVE	CVE-2026-86056	22 Sep 202617:14	–	cve
EUVD	EUVD-2026-84574	22 Sep 202617:14	–	euvd
NVD	CVE-2026-86056	22 Sep 202618:17	–	nvd
Vulnrichment	CVE-2026-86056 Notepad++: Null pointer dereference in NPPM_SAVESESSION message handler causes crash (DoS)	22 Sep 202617:14	–	vulnrichment

[
  {
    "vendor": "notepad-plus-plus",
    "product": "notepad-plus-plus",
    "versions": [
      {
        "version": "< 8.9.8",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-j85c-6wc9-p98p
github	www.github.com/notepad-plus-plus/notepad-plus-plus/commit/8b33f52e7aa488b1222d3cfce5903a38dd63101f
github	www.github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.8
notepad-plus-plus	www.notepad-plus-plus.org/news/v898-released

22 Sep 2026 17:14Current

CVSS 3.15.5

EPSS0.00162

SSVC

CWE-476