Notepad++ version 8.9.9, released on November 9, 2026, fixes six security vulnerabilities, including a serious heap-based buffer overflow. Users are advised to update promptly.
OffSet7 Newsroom · Reviewed by an OffSet7 analyst · AI-assisted
What happened
Notepad++ 8.9.9 update fixes six security vulnerabilities.
Who is affected
Notepad++ version 8.9.9.
Exploited
Potential remote code execution (RCE) and denial of service (DoS).
What to do
Users are advised to update to Notepad++ version 8.9.9 promptly.
Notepad++ version 8.9.9 was released on November 9, 2026, addressing six security vulnerabilities. The update is crucial as it includes a fix for a serious heap-based buffer overflow in the mimeTools plugin's SAML decoder.
The heap-based buffer overflow vulnerability could potentially lead to remote code execution (RCE) and denial of service (DoS).
Other vulnerabilities addressed in this update include a UAC save broker TOCTOU issue, a heap disclosure via unchecked clipboard length, and a UIPI bypass via WM_COPYDATA. These vulnerabilities are categorized as medium risk, with CVSS scores of 6.6, 5.6, and 5.3, respectively.
Currently, the vulnerabilities do not have CVE identifiers assigned. Users are advised to upgrade to the latest version to mitigate potential risks.
Sources
Heise.De: Notepad++ update fixes privilege escalation flaw and more
