CVE-2026-48770CWE-125

Notepad++ WM_COPYDATA COPYDATA_FULL_CMDLINE local DoS crash

Medium · published June 26, 2026

CVSS v3.1
5.0
EPSS
0%
Percentile
3.2
In the wild
Unconfirmed
What it is

Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, a local process in the same interactive Windows session can send a malformed WM_COPYDATA message to Notepad++ using the COPYDATA_FULL_CMDLINE path. The handler appears to process COPYDATASTRUCT.lpData as an unbounded NUL-terminated wchar_t* instead of enforcing COPYDATASTRUCT.cbData. This vulnerability is fixed in 8.9.6.1.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00142 · 3.2th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2026-06-26T20:22Z
EPSS history
Timeline
  • 26 JUN 20:22Z
    Notepad++ WM_COPYDATA COPYDATA_FULL_CMDLINE local DoS crash
    cvelistv5