Notepad++ 8.9.9 fixes six local flaws, including privilege escalation
Original title: Notepad++ 8.9.9 Released to Fix 6 Security Vulnerabilities Allowing Privilege Escalation and Command Execution
Issues affect 8.9.8 and earlier; CVEs are unassigned, and MIME Tools 3.2 fixes decoding flaws through 3.1.
Notepad++ released 8.9.9 on November 6, 2026, fixing six vulnerabilities in interprocess messaging, elevated file saves, clipboard handling, command dispatch, and MIME Tools decoding. Several affect 8.9.8 or earlier and are local rather than unrestricted remote attacks. A WM_COPYDATA trust flaw can escalate privileges only with an elevated instance, NppExec, and a second instance from the same path. GitHub advisories still list no patched version.
Unconfirmed: CVE identifiers are unassigned, GitHub advisories still omit a patched version, and researchers have not shown arbitrary save destinations or command-string control.
- Paste Binary can leak heap data when a declared length exceeds the clipboard buffer.
- A UAC-broker race can replace a temporary file before an elevated protected save.
- Unchecked menu-command indexes can reach ShellExecute, but command control was not shown.
- MIME Tools SAML Decode heap overflows can crash the editor and potentially run code.
- Users should install 8.9.9 officially, verify MIME Tools 3.2, and avoid unnecessary elevation.
Impact: conditional local privilege escalation, heap disclosure, or code execution
| Product | Affected | Fixed in |
|---|---|---|
| Notepad++ | 8.9.8 or earlier | 8.9.9 |
| Notepad++ MIME Tools | through 3.1 | 3.2 |
- 1.Install Notepad++ 8.9.9 from the official release announcement.
- 2.Update MIME Tools to 3.2.
- 3.Avoid unnecessary elevation and review installed plugins.
- Vendors
- Notepad++
- Products
- MIME ToolsNppExec
From the original article
2 min read at gbhackers.com
Notepad++ released version 8. 9. 9 on November 6, 2026, addressing six security vulnerabilities involving interprocess messaging, elevated file saves, clipboard handling, command dispatch, and MIME Tools decoding.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.