5.0 MediumCWE-125
CVE-2026-48770
notepad-plus-plus vulnerability
Status
- Not in CISA KEV
Exploit probabilityEPSSchecked 19 Oct
0.1%probability of exploitation in the next 30 days
Higher than 3% of scored CVEs
SeverityCVSS
5.0Medium
Description NVD
Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, a local process in the same interactive Windows session can send a malformed WM_COPYDATA message to Notepad++ using the COPYDATA_FULL_CMDLINE path. The handler appears to process COPYDATASTRUCT.lpData as an unbounded NUL-terminated wchar_t* instead of enforcing COPYDATASTRUCT.cbData. This vulnerability is fixed in 8.9.6.1.
Coverage No articles yet
No CyberSIXT article names CVE-2026-48770 yet. New articles appear here and in the RSS feed.