Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitymedium

Notepad++ 8.9.9 fixes six local flaws, including plugin command execution

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Notepad++ 8.9.9, released November 6, fixes six local flaws; no CVE identifiers were assigned.

Notepad++ 8.9.9, released November 6, 2026, fixes six flaws in Windows message handling, protected-file saves, clipboard operations, command dispatch, and MIME Tools decoding. Several affect 8.9.8 or earlier and are local rather than unrestricted remote attacks. A WM_COPYDATA trust check could let a local attacker pass plugin commands into an elevated editor only when NppExec was loaded, the target was elevated, and a second instance shared the same path. A same-user temp-file race before an elevated protected save and a Paste Binary heap disclosure were also fixed. MIME Tools through 3.1 has SAML Decode overflows fixed in 3.2. No CVE identifiers were assigned, and GitHub advisories still list no patched version.

Key facts
  • Release 8.9.9 on November 6, 2026, fixes six vulnerabilities.
  • No CVE identifiers were assigned.
  • Escalation needs NppExec, an elevated editor, and a second instance.
  • MIME Tools 3.2 fixes SAML Decode overflows through version 3.1.
  • Paste Binary could copy adjacent heap memory into a document.
  • Testing did not show control of the NPPM_MENUCOMMAND result.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Nov 6, 2026Notepad++ 8.9.9 released with six security fixes · Cyber Security News

What each outlet adds

beyond the shared facts
  • Cyber Security NewsTesting did not show attacker control of NPPM_MENUCOMMAND.
  • GBHackersGitHub advisories still list no patched version.
Vendors
Notepad++
Products
MIME ToolsNppExec

Coverage

oldest first · one row per article · UTC
  1. · 1d ago Cyber Security NewsFirst report

    Notepad++ 8.9.9 fixes six flaws including plugin command execution

    The local escalation needs NppExec, an elevated editor, and a second instance; MIME Tools 3.2 fixes separate overflows.

  2. · 22h ago GBHackers

    Notepad++ 8.9.9 fixes six local flaws, including privilege escalation

    Issues affect 8.9.8 and earlier; CVEs are unassigned, and MIME Tools 3.2 fixes decoding flaws through 3.1.