Notepad++ version 8.9.9 landed on November 6, 2026, bringing fixes for six serious vulnerabilities that could allow malicious use of plugin command execution. These flaws span message handling, protected-file saving, clipboard operations, and MIME decoding. None of the weaknesses had CVE IDs assigned at the time of release.
What Was Wrong
The most concerning issue centers on the Windows message WM_COPYDATA. In version 8.9.8, Notepad++ trusted the window handle supplied by an external sender rather than verifying the sending process’s identity. A local attacker could exploit this by pointing to another legitimate Notepad++ window to meet the trust checks, then push plugin commands into an elevated editor. To pull this off, several conditions needed to be met: the potentially vulnerable NppExec plugin had to be installed and initialized, the target editor had to be running with elevated privileges, and a second instance of Notepad++ running from the same executable path needed to exist. These circumstances mean this is a local, privilege-escalation bug—not a remote code execution risk.
Further WM_COPYDATA weaknesses include a bypass of sender authentication. In addition, there were flaws involving how Notepad++ handled saving files under User Account Control. In those cases, a helper process was used to write protected files. Before the helper took over, a temporary file—used to stage the data—could be swapped by another process running under the same user account, allowing an attacker to replace contents before final write.
Memory Exposures & MIME Decoding Risks
A flaw in the Paste Binary feature allowed a process to claim a large buffer for paste operations but actually supply a smaller one. That inconsistency let Notepad++ read adjacent process memory into a document, exposing heap contents. Similarly, the NPPM_MENUCOMMAND function had unchecked indexes, letting out-of-bounds data reach ShellExecute. Although the malicious control of resulting commands was not demonstrated, the vulnerability still poses risk.
Meanwhile, older versions (up to version 3.1) of the MIME Tools plugin included buffer overflows in their SAML Decode feature. Maliciously crafted input could crash the editor or potentially lead to code execution when decoding. The update to MIME Tools 3.2 corrects these overflow vulnerabilities.
Other Fixes and Improvements
Beyond security, Notepad++ 8.9.9 introduces performance enhancements for Find in Files, upgraded bundled components—Scintilla and Lexilla—and adds controls for dialog fonts. Issues with clipboard history and memory leaks were also addressed.
Users are urged to upgrade to version 8.9.9 via the official download page and ensure that MIME Tools is updated to version 3.2, to protect against the full spectrum of threats fixed in this release.
Why It Matters
This update underlines the danger of trusting input from less vetted sources—even between processes on the same machine. When plugins can be misused and clipboard or temporary files manipulated, local privilege escalations become very possible. This also emphasizes that plugins like MIME Tools, NppExec, and core features like WM_COPYDATA handling deserve scrutiny when elevated privileges are involved.
