CVE-2026-86056

Description

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the NPPM_SAVESESSION handler in PowerEditor/src/NppBigSwitch.cpp converts lParam to a sessionInfo pointer and dereferences its nbFile, files, and sessionFilePathName members without checking for null. A process running at the same or a higher Windows integrity level on the same desktop can send NPPM_SAVESESSION with a null lParam, immediately terminating Notepad++ and causing denial of service and loss of unsaved documents. This issue is fixed in version 8.9.8.

Overview

State: PUBLISHED
Assigner (CNA): GitHub_M
CVSS severity: MEDIUM
CVSS score: 5.5 / 10
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Effective score: 5.5 / 10 MEDIUM source: CNA overview
CWE(s): CWE-476
Reserved: 2026-09-04
Published: 2026-09-22 17:14 UTC
Last updated: 2026-09-22 17:40 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86056.json

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-09-22 18:17:24 UTC
NVD last modified: 2026-09-22 18:17:24 UTC
NVD CVSS v3.1: 5.5 / 10 MEDIUM source: security-advisories@github.com
NVD CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Exploitability subscore: 1.8 / 10
Impact subscore: 3.6 / 10

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-84574
Assigner: GitHub_M
Published: Sep 22, 2026, 5:14:13 PM
Updated: Sep 22, 2026, 5:40:34 PM
EUVD base score (CVSS 3.1): 5.5 / 10
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EUVD-reported EPSS: 0.0000
Vendors: notepad-plus-plus
Products: notepad-plus-plus (< 8.9.8)

ENISA description: Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the NPPM_SAVESESSION handler in PowerEditor/src/NppBigSwitch.cpp converts lParam to a sessionInfo pointer and dereferences its nbFile, files, and sessionFilePathName members without checking for null. A process running at the same or a higher Windows integrity level on the same desktop can send NPPM_SAVESESSION with a null lParam, immediately terminating Notepad++ and causing denial of service and loss of unsaved documents. This issue is fixed in version 8.9.8.

EUVD references (4)

Affected products (1)

Vendor	Product	Versions	Platforms
notepad-plus-plus	notepad-plus-plus	`< 8.9.8` (affected)	—

Vendor references (4)

References embedded in the original CVE record by the assigning CNA.

https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-j85c-6wc9-p98p x_refsource_CONFIRM
https://github.com/notepad-plus-plus/notepad-plus-plus/commit/8b33f52e7aa488b1222d3cfce5903a38dd63101f x_refsource_MISC
https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.8 x_refsource_MISC
https://notepad-plus-plus.org/news/v898-released x_refsource_MISC

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (4)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://github.com/notepad-plus-plus/notepad-plus-plus/commit/8b33f52e7aa488b1222d3cfce5903a38dd63101f security-advisories@github.com
https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.8 security-advisories@github.com
https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-j85c-6wc9-p98p security-advisories@github.com
https://notepad-plus-plus.org/news/v898-released security-advisories@github.com

Remediations (10)

Microsoft Defender Patch Bypass: High Severity Zero-Day Privilege ...

web:arcticwolf.com

Validate Group Policy and registry settings for Defender to ensure real-time protection, automatic remediation , and exclusion policies are secured. Temporary Workarounds Block Vulnerable Apps: Use Microsoft Defender Vulnerability Management to block or warn against execution of affected binaries for systems pending a patch .

2026-09-23 15:43 UTC
Microsoft Confirms Defender RoguePlanet 0-Day Exploit and Working to ...

web:cybersecuritynews.com

Microsoft has officially acknowledged a critical zero-day vulnerability in Microsoft Defender, publicly dubbed "RoguePlanet," and confirmed it is actively developing a security patch to address the flaw.

2026-09-23 15:43 UTC
Defender Zero-Day CVE-2026-50656 Under Active Exploit, No Patch

web:dailysecurityreview.com

Microsoft confirmed CVE - 2026 -50656, a zero-day in the Defender Malware Protection Engine allowing SYSTEM-level privilege escalation, is under active exploitation with no patch currently available.

2026-09-23 15:43 UTC
RoguePlanet: Microsoft Defender Zero-Day CVE-2026-50656

web:labs.cloudsecurityalliance.org

RoguePlanet: Microsoft Defender Zero-Day CVE - 2026 -50656 Key Takeaways CVE - 2026 -50656 ("RoguePlanet") is an unpatched privilege escalation zero-day in the Microsoft Malware Protection Engine that grants attackers SYSTEM-level access on fully patched Windows 10 and Windows 11 systems.

2026-09-23 15:43 UTC
Security Update Guide - Microsoft Security Response Center

web:msrc.microsoft.com

Security Update Guide - Microsoft Security Response Center

2026-09-23 15:43 UTC
Microsoft fixed Defender flaw RoguePlanet (CVE-2026-50656)

web:securityaffairs.com

Microsoft fixed RoguePlanet ( CVE - 2026 -50656), a Defender flaw allowing local attackers to gain higher privileges through the Malware Protection Engine. Microsoft released security updates for RoguePlanet, a vulnerability tracked as CVE - 2026 -50656 (CVSS score of 7.8) affecting the Malware Protection Engine used by Defender. The Microsoft Malware Protection Engine (mpengine.dll) powers Defender ...

2026-09-23 15:43 UTC
Microsoft Patch Tracker (September 2026): Exploit-Ranked | Senserva

web:senserva.com

Every Microsoft security patch (KB) and the CVEs it fixes, with severity, CVSS, and CISA KEV status. Cross-linked to the CVE reference.

2026-09-23 15:43 UTC
CVE-2026-50656 ShieldBreak Claims Defender Fix Bypass — Megathread

web:windowsforum.com

ShieldBreak, a newly published proof of concept from the researcher known as Nightmare Eclipse, claims to bypass Microsoft's July fix for the Microsoft Defender privilege-escalation flaw CVE - 2026 -50656, better known as RoguePlanet.

2026-09-23 15:43 UTC
Microsoft releases fix for RoguePlanet Defender flaw (CVE-2026-50656)

web:www.helpnetsecurity.com

Microsoft has finally released a fix for CVE - 2026 -50656, the Windows Defender LPE vulnerability triggered by the RoguePlanet exploit.

2026-09-23 15:43 UTC
Defender Zero-Day Patched 29 Days After Public Exploit Exposed Millions ...

web:www.techtimes.com

Windows Defender zero-day CVE - 2026 -50656 — known as RoguePlanet — has been patched by Microsoft 29 days after researcher Nightmare Eclipse published working exploit code granting SYSTEM-level ...

2026-09-23 15:43 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-86056.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86056",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T17:40:16.206252Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T17:40:34.136Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "notepad-plus-plus",
          "vendor": "notepad-plus-plus",
          "versions": [
            {
              "status": "affected",
              "version": "< 8.9.8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the NPPM_SAVESESSION handler in PowerEditor/src/NppBigSwitch.cpp converts lParam to a sessionInfo pointer and dereferences its nbFile, files, and sessionFilePathName members without checking for null. A process running at the same or a higher Windows integrity level on the same desktop can send NPPM_SAVESESSION with a null lParam, immediately terminating Notepad++ and causing denial of service and loss of unsaved documents. This issue is fixed in version 8.9.8."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476: NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T17:14:13.141Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-j85c-6wc9-p98p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-j85c-6wc9-p98p"
        },
        {
          "name": "https://github.com/notepad-plus-plus/notepad-plus-plus/commit/8b33f52e7aa488b1222d3cfce5903a38dd63101f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/notepad-plus-plus/notepad-plus-plus/commit/8b33f52e7aa488b1222d3cfce5903a38dd63101f"
        },
        {
          "name": "https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.8"
        },
        {
          "name": "https://notepad-plus-plus.org/news/v898-released",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://notepad-plus-plus.org/news/v898-released"
        }
      ],
      "source": {
        "advisory": "GHSA-j85c-6wc9-p98p",
        "discovery": "UNKNOWN"
      },
      "title": "Notepad++: Null pointer dereference in NPPM_SAVESESSION message handler causes crash (DoS)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-86056",
    "datePublished": "2026-09-22T17:14:13.141Z",
    "dateReserved": "2026-09-04T19:29:21.059Z",
    "dateUpdated": "2026-09-22T17:40:34.136Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}