Notepad++ 8.9.9: Update Fixes Plugin Command Execution and Five Other Flaws

Notepad++ 8.9.9, released on 6 November 2026, fixes six vulnerabilities in the Windows text editor, per Notepad++’s own release notes. The highest-profile one lets a local, lower-privilege process reach plugin command execution in an elevated Notepad++ process through the optional NppExec plugin. Update to 8.9.9 to get all six fixes; none has a CVE id yet.

What Does Notepad++ 8.9.9 Fix?

GitHub’s security-advisory list for the notepad-plus-plus/notepad-plus-plus repository, published by the project’s own maintainer, covers five of the six fixes; the sixth has its own advisory on a sibling repository (see below). Four of those five name Notepad++ 8.9.8 as affected, two as the range 8.9.8 and earlier and two as 8.9.8 itself; the fifth, an earlier WM_COPYDATA file-open bypass, names 8.9.7 and earlier. Three of the five give a CVSS 3.1 score and none gives a CVSS 4.0 score; the WM_COPYDATA-to-NppExec advisory gives no CVSS score at all.

Notepad++’s release notes list one more fix beyond this table’s rows: a heap buffer overflow and decompression-bomb issue in the SAML decode routine of the MIME Tools plugin, fixed in MIME Tools 3.2. That fix has its own GitHub advisory, GHSA-554x-h7h6-gqfm, published 6 November 2026 on the MIME Tools plugin’s own repository rather than on the main Notepad++ repository; it gives no CVE id as of 10 November 2026.

How Does the Plugin Command Execution Bypass Work?

Notepad++ checks a `WM_COPYDATA` sender by looking at the process that owns the window handle named in the message, per GitHub’s advisory. That handle is attacker-supplied, and it is not bound to the process that actually sent the message. A local, same-user process can therefore name a separate, legitimate Notepad++ window as the sender and supply its own data instead.

With the optional NppExec plugin installed and already running elevated, GitHub’s advisory says a spoofed message can make NppExec run a command from that elevated context. The advisory calls this conditional local high-integrity code execution, not remote code execution, and credits reporter sigure21.

A [[local privilege escalation::An attacker who already runs code on a machine gets higher-level access than their current account allows.]] of this kind depends on the NppExec plugin being installed and already elevated; Notepad++’s core advisory does not state how common that configuration is among its users. Our privilege escalation glossary entry and the T1068 exploitation for privilege escalation technique page cover the general pattern.

What Should You Do About Notepad++ 8.9.9 Now?

1. Update every installReplace the running Notepad++ build with 8.9.9 from the project’s own download page, on every machine, including portable copies.
2. Confirm the versionCheck Help then About Notepad++ after updating. Four of the five main-repo GitHub advisories list only builds up to 8.9.8 as affected; one, GHSA-pg39-63h5-cx35, extends to 8.9.7 and earlier.
3. Prioritize hosts with NppExec elevatedUpdate first wherever a shared or multi-user machine runs Notepad++ with the NppExec plugin already elevated. GitHub’s advisory names NppExec 0.8.12.1 as the plugin the bypass used to reach execution.
4. Track the advisory page, not a CVE idNone of the six 8.9.9 fixes has a CVE id yet, per Notepad++’s own release notes and GitHub’s advisories. We recommend watching the project’s own advisory list rather than a CVE search.

A GitHub search for NppExec and WM_COPYDATA on 10 November 2026 returned the NppExec plugin’s own repository and routine user automation scripts, not proof-of-concept code for this flaw. Our patch management entry covers how to roll an update like this one out across many machines.