Notepad++ 8.9.9 fixes six flaws including plugin command execution
Original title: Notepad++ 8.9.9 Released With Fixes for 6 Vulnerabilities Allowing Plugin Command Execution
The local escalation needs NppExec, an elevated editor, and a second instance; MIME Tools 3.2 fixes separate overflows.
Notepad++ 8.9.9, released November 6, 2026, fixes six flaws in Windows message handling, protected-file saves, clipboard operations, and MIME Tools decoding. No CVE identifiers were assigned. In 8.9.8, a WM_COPYDATA trust check could let a local attacker pass plugin commands into an elevated editor when NppExec was loaded. A same-user temp-file race and a Paste Binary heap disclosure were also fixed.
Unconfirmed: No CVE identifiers were assigned, and real-world exploitation is not stated.
- The demonstrated escalation needed NppExec, an elevated target, and a second instance.
- A same-user process could replace temp-file contents before an elevated helper saved them.
- Paste Binary could copy adjacent heap memory into a document.
- MIME Tools through 3.1 has SAML Decode overflows; version 3.2 fixes them.
- Testing did not show attacker control of the NPPM_MENUCOMMAND result.
Impact: local plugin command execution in an elevated editor
| Product | Affected | Fixed in |
|---|---|---|
| Notepad++ | 8.9.8 | 8.9.9 |
| Notepad++ MIME Tools | through 3.1 | 3.2 |
- 1.Install Notepad++ 8.9.9 from the official download page.
- 2.Update MIME Tools to 3.2.
- Vendors
- Notepad++
- Products
- MIME ToolsNppExec
From the original article
2 min read at cybersecuritynews.com
Notepad++ released version 8. 9. 9 on November 6, 2026, fixing six security flaws across Windows message handling, protected file saving, clipboard operations, and MIME Tools decoding.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.