Notepad++ 8.9.9 Fixes 6 Vulnerabilities (Local Privilege Escalation, Command Dispatch, Heap Overflows in MIME Tools) - No CVEs Assigned

Key facts

Detection coverage

As of 2026-11-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5612 across Splunk SPL, Microsoft KQL and Sigma, covering 6 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Notepad++ Spawning Shell or Script Host (ShellExecute / NppExec Execution) — Post-Exploitation

Detects notepad++.exe as the parent of cmd, PowerShell, WSH, mshta, rundll32, regsvr32, bitsadmin, certutil or curl. The NPPM_MENUCOMMAND flaw (GHSA-j327-595g-jg4c) passes an out-of-bounds command string to ShellExecute, and spoofed WM_COPYDATA messages can drive NppExec scripts (GHSA-5jjv-2h6g-63p5). Elevated children rank first.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1203, T1106, T1559
• Data sources: sysmon:EventCode=1, DeviceProcessEvents, windows process_creation
• Severity: high
• Confidence: medium

Splunk SPL

```Notepad++ spawning shells/script hosts: ShellExecute sink (NPPM_MENUCOMMAND ID_USER_CMD) or NppExec launch```
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\notepad++.exe" (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\certutil.exe" OR Image="*\\curl.exe")
| eval elevated=if(IntegrityLevel IN ("High","System"),1,0)
| stats count as events max(elevated) as any_elevated values(CommandLine) as command_lines values(User) as users by ComputerName ParentImage Image
| sort - any_elevated - events

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "notepad++.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "bitsadmin.exe", "certutil.exe", "curl.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, ProcessIntegrityLevel, InitiatingProcessCommandLine
| order by Timestamp desc

Sigma

title: Notepad++ Spawning Command Interpreter or Script Host
id: 6f1c2a54-3b7e-4d0a-9c15-5612a0000002
status: experimental
description: Detects notepad++.exe launching shells or LOLBins. Reachable through NPPM_MENUCOMMAND out-of-bounds ID_USER_CMD indexing to ShellExecute (GHSA-j327-595g-jg4c) or NppExec scripts triggered by spoofed WM_COPYDATA (GHSA-5jjv-2h6g-63p5).
references:
    - https://notepad-plus-plus.org/news/v899-released/
    - https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-j327-595g-jg4c
    - https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-5jjv-2h6g-63p5
author: Threadlinqs Team
date: 2026/11/10
tags:
    - attack.execution
    - attack.t1203
    - attack.t1106
    - attack.t1559
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\notepad++.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\bitsadmin.exe'
            - '\certutil.exe'
            - '\curl.exe'
    condition: selection
falsepositives:
    - Developers using the NppExec plugin or Run menu to launch scripts
    - User-defined commands in shortcuts.xml that start cmd or PowerShell
level: high

Known false positives:

• Developers running scripts with the NppExec plugin or Run menu
• User-defined commands configured in shortcuts.xml

Tuning notes: Baseline hosts where NppExec is legitimately used and allow-list known command lines. Raise priority when IntegrityLevel is High or the parent notepad++.exe was started from the same path as a decoy instance. Remove noisy interpreters after review.

• 🔒 Vulnerable Notepad++ (< 8.9.9) Executing — Exploit Exposure · unlock with TL Creds
• 🔒 High-Integrity Child Process of Notepad++ ([indicator] Conditional LPE) — Post-Exploitation · unlock with TL Creds
• 🔒 [indicator] or MIME Tools Plugin Loaded Into Notepad++ — Precondition Inventory · unlock with TL Creds
• 🔒 PowerShell Sending WM_COPYDATA / NPPM_MENUCOMMAND to Notepad++ — IPC Exploitation · unlock with TL Creds
• 🔒 Script Publishing [indicator] Clipboard Format — Paste Binary Heap Over-Read · unlock with TL Creds
• 🔒 Notepad++ Writing to System32, Tasks or Startup Locations — Protected File Content Substitution · unlock with TL Creds
• 🔒 Notepad++ Elevated runas Self-Relaunch With Temp File (UAC Save Broker TOCTOU) — Exploitation · unlock with TL Creds
• 🔒 Notepad++ Crash Faulting in [indicator].dll or Heap Corruption (SAML Decode Overflow) — Exploit Impact · unlock with TL Creds

Indicators of compromise

As of 2026-11-10, Threadlinqs Intelligence tracks 6 indicators of compromise for TL-2026-5612.

Technical analysis

No CVEs are assigned and no in-the-wild exploitation is reported.

On 2026-11-06 the Notepad++ project released version 8.9.9 together with MIME Tools 3.2, publishing six GitHub security advisories. The vendor release page states 'CVE ID not assigned yet' for every item. No exploitation in the wild, threat actor, or network IOC is reported in any source. Several advisories still list no patched version even though 8.9.9 is the release that carries the fixes, so defenders should verify the installed version rather than rely on advisory metadata.

1) GHSA-pg39-63h5-cx35 (WM_COPYDATA sender authentication / UIPI bypass, CWE-346, GitHub Moderate, CVSS 3.1 5.3 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, affects <=8.9.7, published 2026-10-27). Notepad++ exempts WM_COPYDATA from User Interface Privilege Isolation on its main window but the handler never checks the sender. A low-integrity process (for example a browser sandbox) can make a medium-integrity Notepad++ open and activate an attacker-chosen file; if Notepad++ is elevated, a standard-user process can trigger opens at elevated access. The advisory includes a PoC script; notepad.exe rejected the same message with ACCESS_DENIED. Credit: tomchuoi (Hung Bach Ngoc, VinSOC Labs).

2) GHSA-5jjv-2h6g-63p5 (WM_COPYDATA sender authentication bypass enabling conditional High-integrity execution via NppExec, CWE-940 with CWE-345 suggested, GitHub Moderate, reporter-suggested CVSS 3.1 7.0 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, affects 8.9.8, published 2026-11-06). The isSenderTrusted(wParam) check treats the caller-supplied wParam as the sender window and only verifies that window's owner process for Medium-or-higher integrity and a matching executable path. A local attacker passes the window handle of a legitimate Notepad++ decoy running from the same path while sending the data from an unrelated process. With the optional NppExec 0.8.12.1 plugin initialized in an already elevated target, a benign marker script ran in the High-integrity context. AC:H reflects the required plugin, initialization, pre-elevated target and exact-path decoy. The reporter classifies this as conditional local privilege escalation, not network RCE, and suggests it may be an incomplete fix of GHSA-pg39-63h5-cx35 and recommends an OS-authenticated channel (named pipe with peer identity checks). Credit: sigure21.

3) GHSA-w7wv-vg94-7pvp (UAC save broker TOCTOU, CWE-367 and provisionally CWE-377, GitHub Moderate, CVSS 3.1 6.6 AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H, affects 8.9.8, published 2026-11-06). When a normal save fails with access denied, Notepad++ writes the document to a predictably named temp file in the user's temp directory and launches its own executable with the runas verb, passing the temp path and protected destination. The elevated helper copies the file without confirming it is the one the editor wrote. A same-user process can swap the contents between the editor closing the file and the helper copying it; if the user approves the legitimate UAC prompt, attacker bytes land in the protected file. Only control over content written to the user-selected destination is confirmed; arbitrary destination redirection and code execution were not tested. Credit: sigure21.

4) GHSA-h5cv-65m7-x97v (Paste Binary heap disclosure, CWE-125, GitHub Moderate, CVSS 3.1 5.6 AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N, affects <=8.9.8, published 2026-11-06). Binary copy/paste uses CF_TEXT for the bytes and a private clipboard format named 'Notepad++ Binary Length' for the count. On paste the count is used without checking it against the CF_TEXT allocation; a local process can publish mismatched values so adjacent heap memory is inserted into the document (a 3-byte buffer with declared length 4096 yielded 4096 bytes in the saved file containing live process memory). A second path in the Clipboard History panel uses the same unchecked length and triggers when the panel is open; it was not reproduced. Credit: Thai Son Dinh (sondt99), VinSOC Labs R&D.

5) GHSA-j327-595g-jg4c (out-of-bounds array index via NPPM_MENUCOMMAND, CWE-129, GitHub Moderate, CVSS 3.1 5.3 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, affects <=8.9.8, published 2026-11-06). The ID_USER_CMD and ID_MACRO command ranges index std::vector objects without a size check; the command ID arrives via NPPM_MENUCOMMAND, which has no sender validation. Both vectors are empty on a default install, so the index reads out of bounds, and for the user-command branch the out-of-bounds element's command string is passed to ShellExecute. The PoC (run under Wine) showed the call reaching ShellExecute and a modal error dialog; attacker control of the memory contents is not demonstrated. A local process at the same or higher integrity can trigger it without user interaction. Credit: sondt99.

6) GHSA-554x-h7h6-gqfm (MIME Tools SAML Decode heap buffer overflow and decompression bomb, npp-plugins/mimetools, GitHub severity High, CVSS not listed, affects <=3.1, fixed in 3.2, published 2026-11-06; CWE-122 and CWE-409 cited in the details). DEFLATE decompression does not enforce the output buffer capacity (SAML_MESSAGE_MAX_SIZE of 200,000 bytes), uncompressed XML input is memcpy'd without checking the decoded length, and a second memcpy after inflation can overflow because the inflated length is unbounded. Impact is a crash or potentially arbitrary code execution when a user decodes a malicious payload with Plugins > MIME Tools > SAML Decode; the sample payload inflates to about 300,000 bytes. Credit: phmngcthanh, TristanInSec, tomchuoi, sondt99.

Related history from a search result: an earlier WM_COPYDATA flaw, CVE-2026-48770 (GHSA-r39g-3mcw-xcg2, local denial of service by malformed message, CVSS 5.0), was fixed in 8.9.6.1, indicating repeated hardening of the WM_COPYDATA/message-handling surface. Overall risk is limited by local-access and precondition requirements, which is why severity is rated MEDIUM here as an analyst placeholder; the aggregate CVSS is left null because each advisory carries its own score.

MITRE ATT&CK techniques by tactic:

Execution

T1106 Native API; T1203 Exploitation for Client Execution; T1559 Inter-Process Communication

Stealth

T1211 Exploitation for Stealth

Impact

T1499.004 Application or System Exploitation; T1565.001 Stored Data Manipulation

Privilege Escalation

T1548 Abuse Elevation Control Mechanism

Remediation

Patches

• Notepad++ 8.9.9 (released 2026-11-06)
• MIME Tools 3.2

Immediate actions

• Upgrade Notepad++ to 8.9.9 or later on all endpoints and confirm the installed version, since several GitHub advisories list no patched version
• Upgrade the MIME Tools plugin to 3.2 or later (affected: 3.1 and earlier) or remove it if SAML Decode is not needed
• Avoid running Notepad++ elevated with the NppExec plugin initialized until 8.9.9 is deployed

Workarounds

• Do not decode untrusted SAML payloads with MIME Tools SAML Decode before updating
• Avoid saving to protected locations through the UAC save flow while untrusted local code may be running
• Do not use Paste Binary or open the Clipboard History panel while untrusted local processes are active

Longer-term hardening

• Inventory installed Notepad++ plugins (NppExec, mimeTools) and remove unneeded ones
• Monitor for suspicious processes sending WM_COPYDATA or NPPM_MENUCOMMAND messages to notepad++.exe and for unexpected runas launches of notepad++.exe
• Track the vendor release page and GitHub advisories for CVE assignment and updated patched-version metadata

Affected and fixed versions

• Notepad++ — Notepad++ (Windows desktop application)
  Vulnerable versions: 8.9.8 and earlier (GHSA-pg39-63h5-cx35 lists <=8.9.7)
  Fixed in: 8.9.9
• Notepad++ community (npp-plugins) — MIME Tools (mimeTools) plugin
  Vulnerable versions: 3.1 and earlier
  Fixed in: 3.2
• Notepad++ plugin ecosystem — NppExec plugin (precondition for the conditional privilege escalation)
  Vulnerable versions: 0.8.12.1 (tested in GHSA-5jjv-2h6g-63p5)
  Fixed in: Fix delivered in Notepad++ 8.9.9, not in the plugin

Timeline

• 2026-10-27 GHSA-pg39-63h5-cx35 (WM_COPYDATA UIPI / sender authentication bypass, affects <=8.9.7) is published by the Notepad++ maintainer, credited to tomchuoi (VinSOC Labs).
• 2026-11-06 Notepad++ 8.9.9 is released with fixes for six security issues; the release page shows no CVE IDs assigned yet.
• 2026-11-06 GHSA-554x-h7h6-gqfm (MIME Tools SAML Decode heap overflow and decompression bomb, affects <=3.1) is published; MIME Tools 3.2 is the patched version.
• 2026-11-06 GHSA-w7wv-vg94-7pvp (UAC save broker TOCTOU), GHSA-h5cv-65m7-x97v (Paste Binary heap disclosure) and GHSA-j327-595g-jg4c (NPPM_MENUCOMMAND out-of-bounds index) are published, all rated Moderate by GitHub.
• 2026-11-06 GHSA-5jjv-2h6g-63p5 is published: a spoofed-wParam bypass of the sender check enabling conditional High-integrity execution through the NppExec plugin (reporter: sigure21); the reporter suggests it may be an incomplete fix of GHSA-pg39-63h5-cx35.
• 2026-11-10 GBHackers reports the 8.9.9 fixes, noting no CVEs, no in-the-wild exploitation, and that several advisories list no patched version.

Sources cited

• GHSA-pg39-63h5-cx35: Notepad++ UIPI Bypass via WM_COPYDATA GitHub · Advisory · 2026-10-27
• GHSA-5jjv-2h6g-63p5: WM_COPYDATA sender authentication bypass enables conditional High-integrity execution via NppExec GitHub · Advisory · 2026-11-06
• GHSA-w7wv-vg94-7pvp: UAC save broker TOCTOU allows local content substitution in protected files GitHub · Advisory · 2026-11-06
• GHSA-h5cv-65m7-x97v: Heap disclosure via unchecked clipboard length in Paste Binary GitHub · Advisory · 2026-11-06
• GHSA-j327-595g-jg4c: Out-of-bounds array index via NPPM_MENUCOMMAND GitHub · Advisory · 2026-11-06
• GHSA-554x-h7h6-gqfm: Heap Buffer Overflow and Decompression Bomb in SAML Decode (mimetools) GitHub · Advisory · 2026-11-06
• Notepad++ v8.9.9 Release Notes notepad-plus-plus.org · Vendor report · 2026-11-06
• CVE-2026-48770 (earlier Notepad++ WM_COPYDATA DoS, fixed in 8.9.6.1) - SentinelOne vulnerability database SentinelOne · Research
• Notepad++ 8.9.9 Released to Fix 6 Security Vulnerabilities Allowing Privilege Escalation and Command Execution gbhackers.com · News · 2026-11-10

More in vulnerability

• CVE-2026-119618: Critical Unauthenticated RCE via Race Condition in Apache HTTP Server mod_http2 assign_headers()
• Axis Camera Station and Camera Station Pro: Multiple Vulnerabilities (CVE-2026-13312, CVE-2026-12389, CVE-2026-12964 and others)
• N-able N-central: 33 Alleged Zero-Day Vulnerabilities Published with PoC ("Able2Shell" XXE-to-RCE chain); Platform Taken Offline
• Apple Libnotify/notifyd Stack-Based Buffer Overflow (CVE-2026-64739)
• Critical Zoom Workplace for Windows Flaws (CVE-2026-108186, CVE-2026-108187) Allow Unauthenticated Remote Privilege Escalation

Other reports on CVE-2026-48770

• Notepad++ v8.9.6 — Critical Arbitrary Code Execution via config.xml commandLineInterpreter and shortcuts.xml (CVE-2026-48770, CVE-2026-48778, CVE-2026-48800)

Previous and next in vulnerability

• Google Chrome XML Use-After-Free Zero-Day Exploited in the Wild (CVE-2026-125350) Previous report
• Apache Airflow CeleryExecutor Unauthenticated RCE via Forged Broker Callback (CVE-2026-68982) Next report