{"id":"CVE-2026-48770","aliases":["EUVD-2026-39908","GHSA-r39g-3mcw-xcg2"],"status":"published","title":"Notepad++ WM_COPYDATA COPYDATA_FULL_CMDLINE local DoS crash","description":"Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, a local process in the same interactive Windows session can send a malformed WM_COPYDATA message to Notepad++ using the COPYDATA_FULL_CMDLINE path. The handler appears to process COPYDATASTRUCT.lpData as an unbounded NUL-terminated wchar_t* instead of enforcing COPYDATASTRUCT.cbData. This vulnerability is fixed in 8.9.6.1.","severity":{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00142,"percentile":0.03542,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-125"],"published":"2026-06-26T20:22:17Z","modified":"2026-10-28T11:11:27Z","exploits":[{"source":"pocgithub","id":"atiilla/Notepad-8.9.6-PoC","title":"atiilla/Notepad-8.9.6-PoC","date":"2026-05-28","url":"https://github.com/atiilla/Notepad-8.9.6-PoC"}],"products":[{"vendor":"notepad-plus-plus","product":"notepad-plus-plus"},{"vendor":"notepad-plus-plus","product":"notepad\\+\\+"}],"references":[{"url":"https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-r39g-3mcw-xcg2","tags":["x_refsource_CONFIRM","exploit","Exploit","Patch","Vendor Advisory","Mitigation","advisory"]},{"url":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/f20a0888a92ce557a339b833cd9d9d8e97dc797d","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48770.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48770","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-48770","title":"Notepad++ WM_COPYDATA COPYDATA_FULL_CMDLINE local DoS crash","description":"Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, a local process in the same interactive Windows session can send a malformed WM_COPYDATA message to Notepad++ using the COPYDATA_FULL_CMDLINE path. The handler appears to process COPYDATASTRUCT.lpData as an unbounded NUL-terminated wchar_t* instead of enforcing COPYDATASTRUCT.cbData. This vulnerability is fixed in 8.9.6.1.","status":"published","published":"2026-06-26T20:22:17.683Z","modified":"2026-06-29T12:11:59.84Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:19:47.998488Z"}],"euvd":[{"id":"EUVD-2026-39908","description":"Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, a local process in the same interactive Windows session can send a malformed WM_COPYDATA message to Notepad++ using the COPYDATA_FULL_CMDLINE path. The handler appears to process COPYDATASTRUCT.lpData as an unbounded NUL-terminated wchar_t* instead of enforcing COPYDATASTRUCT.cbData. This vulnerability is fixed in 8.9.6.1.","status":"published","published":"2026-06-26T20:22:17Z","modified":"2026-06-29T12:11:59Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:20:23.349194Z"}],"nvd":[{"id":"CVE-2026-48770","description":"Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, a local process in the same interactive Windows session can send a malformed WM_COPYDATA message to Notepad++ using the COPYDATA_FULL_CMDLINE path. The handler appears to process COPYDATASTRUCT.lpData as an unbounded NUL-terminated wchar_t* instead of enforcing COPYDATASTRUCT.cbData. This vulnerability is fixed in 8.9.6.1.","status":"published","published":"2026-06-26T21:16:34.033Z","modified":"2026-06-29T21:21:52.51Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:12:26.508751Z"}],"osv":[{"id":"CVE-2026-48770","title":"Notepad++ WM_COPYDATA COPYDATA_FULL_CMDLINE local DoS crash","description":"Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, a local process in the same interactive Windows session can send a malformed WM_COPYDATA message to Notepad++ using the COPYDATA_FULL_CMDLINE path. The handler appears to process COPYDATASTRUCT.lpData as an unbounded NUL-terminated wchar_t* instead of enforcing COPYDATASTRUCT.cbData. This vulnerability is fixed in 8.9.6.1.","status":"published","published":"2026-06-26T20:22:17.683Z","modified":"2026-10-28T11:11:27.066569999Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:45:06.701612Z"}]}}