# Notepad++ 8.9.9 Fixes 6 Vulnerabilities (Local Privilege Escalation, Command Dispatch, Heap Overflows in MIME Tools) - No CVEs Assigned

> Notepad++ 8.9.9 (released 2026-11-06) and MIME Tools 3.2 fix six locally exploitable flaws: a WM_COPYDATA sender-authentication bypass, a conditional local privilege escalation via spoofed NppExec plugin messages, a TOCTOU flaw in the UAC save broker, a Paste Binary clipboard over-read, unchecked NPPM_MENUCOMMAND indexes reaching ShellExecute, and MIME Tools SAML Decode heap overflows. No CVEs are assigned and no in-the-wild exploitation is reported.

- **Published:** 2026-11-10T05:03:16Z
- **Last reviewed:** 2026-11-10T05:03:16Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5612
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5612.png
- **ID:** TL-2026-5612
- **Severity:** MEDIUM
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 6
- **CVEs:** CVE-2026-48770

## Description

On 2026-11-06 the Notepad++ project released version 8.9.9 together with MIME Tools 3.2, publishing six GitHub security advisories. The vendor release page states 'CVE ID not assigned yet' for every item. No exploitation in the wild, threat actor, or network IOC is reported in any source. Several advisories still list no patched version even though 8.9.9 is the release that carries the fixes, so defenders should verify the installed version rather than rely on advisory metadata.

1) GHSA-pg39-63h5-cx35 (WM_COPYDATA sender authentication / UIPI bypass, CWE-346, GitHub Moderate, CVSS 3.1 5.3 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, affects <=8.9.7, published 2026-10-27). Notepad++ exempts WM_COPYDATA from User Interface Privilege Isolation on its main window but the handler never checks the sender. A low-integrity process (for example a browser sandbox) can make a medium-integrity Notepad++ open and activate an attacker-chosen file; if Notepad++ is elevated, a standard-user process can trigger opens at elevated access. The advisory includes a PoC script; notepad.exe rejected the same message with ACCESS_DENIED. Credit: tomchuoi (Hung Bach Ngoc, VinSOC Labs).

2) GHSA-5jjv-2h6g-63p5 (WM_COPYDATA sender authentication bypass enabling conditional High-integrity execution via NppExec, CWE-940 with CWE-345 suggested, GitHub Moderate, reporter-suggested CVSS 3.1 7.0 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, affects 8.9.8, published 2026-11-06). The isSenderTrusted(wParam) check treats the caller-supplied wParam as the sender window and only verifies that window's owner process for Medium-or-higher integrity and a matching executable path. A local attacker passes the window handle of a legitimate Notepad++ decoy running from the same path while sending the data from an unrelated process. With the optional NppExec 0.8.12.1 plugin initialized in an already elevated target, a benign marker script ran in the High-integrity context. AC:H reflects the required plugin, initialization, pre-elevated target and exact-path decoy. The reporter classifies this as conditional local privilege escalation, not network RCE, and suggests it may be an incomplete fix of GHSA-pg39-63h5-cx35 and recommends an OS-authenticated channel (named pipe with peer identity checks). Credit: sigure21.

3) GHSA-w7wv-vg94-7pvp (UAC save broker TOCTOU, CWE-367 and provisionally CWE-377, GitHub Moderate, CVSS 3.1 6.6 AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H, affects 8.9.8, published 2026-11-06). When a normal save fails with access denied, Notepad++ writes the document to a predictably named temp file in the user's temp directory and launches its own executable with the runas verb, passing the temp path and protected destination. The elevated helper copies the file without confirming it is the one the editor wrote. A same-user process can swap the contents between the editor closing the file and the helper copying it; if the user approves the legitimate UAC prompt, attacker bytes land in the protected file. Only control over content written to the user-selected destination is confirmed; arbitrary destination redirection and code execution were not tested. Credit: sigure21.

4) GHSA-h5cv-65m7-x97v (Paste Binary heap disclosure, CWE-125, GitHub Moderate, CVSS 3.1 5.6 AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N, affects <=8.9.8, published 2026-11-06). Binary copy/paste uses CF_TEXT for the bytes and a private clipboard format named 'Notepad++ Binary Length' for the count. On paste the count is used without checking it against the CF_TEXT allocation; a local process can publish mismatched values so adjacent heap memory is inserted into the document (a 3-byte buffer with declared length 4096 yielded 4096 bytes in the saved file containing live process memory). A second path in the Clipboard History panel uses the same unchecked length and triggers when the panel is open; it was not reproduced. Credit: Thai Son Dinh (sondt99), VinSOC Labs R&D.

5) GHSA-j327-595g-jg4c (out-of-bounds array index via NPPM_MENUCOMMAND, CWE-129, GitHub Moderate, CVSS 3.1 5.3 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, affects <=8.9.8, published 2026-11-06). The ID_USER_CMD and ID_MACRO command ranges index std::vector objects without a size check; the command ID arrives via NPPM_MENUCOMMAND, which has no sender validation. Both vectors are empty on a default install, so the index reads out of bounds, and for the user-command branch the out-of-bounds element's command string is passed to ShellExecute. The PoC (run under Wine) showed the call reaching ShellExecute and a modal error dialog; attacker control of the memory contents is not demonstrated. A local process at the same or higher integrity can trigger it without user interaction. Credit: sondt99.

6) GHSA-554x-h7h6-gqfm (MIME Tools SAML Decode heap buffer overflow and decompression bomb, npp-plugins/mimetools, GitHub severity High, CVSS not listed, affects <=3.1, fixed in 3.2, published 2026-11-06; CWE-122 and CWE-409 cited in the details). DEFLATE decompression does not enforce the output buffer capacity (SAML_MESSAGE_MAX_SIZE of 200,000 bytes), uncompressed XML input is memcpy'd without checking the decoded length, and a second memcpy after inflation can overflow because the inflated length is unbounded. Impact is a crash or potentially arbitrary code execution when a user decodes a malicious payload with Plugins > MIME Tools > SAML Decode; the sample payload inflates to about 300,000 bytes. Credit: phmngcthanh, TristanInSec, tomchuoi, sondt99.

Related history from a search result: an earlier WM_COPYDATA flaw, CVE-2026-48770 (GHSA-r39g-3mcw-xcg2, local denial of service by malformed message, CVSS 5.0), was fixed in 8.9.6.1, indicating repeated hardening of the WM_COPYDATA/message-handling surface. Overall risk is limited by local-access and precondition requirements, which is why severity is rated MEDIUM here as an analyst placeholder; the aggregate CVSS is left null because each advisory carries its own score.

## MITRE ATT&CK

- T1548 Abuse Elevation Control Mechanism
- T1559 Inter-Process Communication
- T1203 Exploitation for Client Execution
- T1106 Native API
- T1211 Exploitation for Stealth
- T1565.001 Stored Data Manipulation
- T1499.004 Application or System Exploitation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Notepad++ Spawning Shell or Script Host (ShellExecute / NppExec Execution) — Post-Exploitation** (`TL-2026-5612-SPL-002`)

Detects notepad++.exe as the parent of cmd, PowerShell, WSH, mshta, rundll32, regsvr32, bitsadmin, certutil or curl. The NPPM_MENUCOMMAND flaw (GHSA-j327-595g-jg4c) passes an out-of-bounds command string to ShellExecute, and spoofed WM_COPYDATA messages can drive NppExec scripts (GHSA-5jjv-2h6g-63p5). Elevated children rank first.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1203, T1106, T1559
- **Data sources:** sysmon:EventCode=1, DeviceProcessEvents, windows process_creation
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

````spl
```Notepad++ spawning shells/script hosts: ShellExecute sink (NPPM_MENUCOMMAND ID_USER_CMD) or NppExec launch```
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\notepad++.exe" (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\certutil.exe" OR Image="*\\curl.exe")
| eval elevated=if(IntegrityLevel IN ("High","System"),1,0)
| stats count as events max(elevated) as any_elevated values(CommandLine) as command_lines values(User) as users by ComputerName ParentImage Image
| sort - any_elevated - events
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "notepad++.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "bitsadmin.exe", "certutil.exe", "curl.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, ProcessIntegrityLevel, InitiatingProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: Notepad++ Spawning Command Interpreter or Script Host
id: 6f1c2a54-3b7e-4d0a-9c15-5612a0000002
status: experimental
description: Detects notepad++.exe launching shells or LOLBins. Reachable through NPPM_MENUCOMMAND out-of-bounds ID_USER_CMD indexing to ShellExecute (GHSA-j327-595g-jg4c) or NppExec scripts triggered by spoofed WM_COPYDATA (GHSA-5jjv-2h6g-63p5).
references:
    - https://notepad-plus-plus.org/news/v899-released/
    - https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-j327-595g-jg4c
    - https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-5jjv-2h6g-63p5
author: Threadlinqs Team
date: 2026/11/10
tags:
    - attack.execution
    - attack.t1203
    - attack.t1106
    - attack.t1559
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\notepad++.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\bitsadmin.exe'
            - '\certutil.exe'
            - '\curl.exe'
    condition: selection
falsepositives:
    - Developers using the NppExec plugin or Run menu to launch scripts
    - User-defined commands in shortcuts.xml that start cmd or PowerShell
level: high

```

**Known false positives:**

- Developers running scripts with the NppExec plugin or Run menu
- User-defined commands configured in shortcuts.xml

**Tuning notes:** Baseline hosts where NppExec is legitimately used and allow-list known command lines. Raise priority when IntegrityLevel is High or the parent notepad++.exe was started from the same path as a decoy instance. Remove noisy interpreters after review.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Vulnerable Notepad++ (< 8.9.9) Executing — Exploit Exposure (locked: unlock with TL Creds)
- High-Integrity Child Process of Notepad++ ([indicator] Conditional LPE) — Post-Exploitation (locked: unlock with TL Creds)
- [indicator] or MIME Tools Plugin Loaded Into Notepad++ — Precondition Inventory (locked: unlock with TL Creds)
- PowerShell Sending WM_COPYDATA / NPPM_MENUCOMMAND to Notepad++ — IPC Exploitation (locked: unlock with TL Creds)
- Script Publishing [indicator] Clipboard Format — Paste Binary Heap Over-Read (locked: unlock with TL Creds)
- Notepad++ Writing to System32, Tasks or Startup Locations — Protected File Content Substitution (locked: unlock with TL Creds)
- Notepad++ Elevated runas Self-Relaunch With Temp File (UAC Save Broker TOCTOU) — Exploitation (locked: unlock with TL Creds)
- Notepad++ Crash Faulting in [indicator].dll or Heap Corruption (SAML Decode Overflow) — Exploit Impact (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Notepad++ 8.9.9 Released to Fix 6 Security Vulnerabilities Allowing Privilege Escalation and Command Execution](https://gbhackers.com/notepad-8-9-9-released-to-fix-6-security-vulnerabilities/)
- [Notepad++ v8.9.9 Release Notes](https://notepad-plus-plus.org/news/v899-released/)
- [GHSA-pg39-63h5-cx35: Notepad++ UIPI Bypass via WM_COPYDATA](https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-pg39-63h5-cx35)
- [GHSA-5jjv-2h6g-63p5: WM_COPYDATA sender authentication bypass enables conditional High-integrity execution via NppExec](https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-5jjv-2h6g-63p5)
- [GHSA-w7wv-vg94-7pvp: UAC save broker TOCTOU allows local content substitution in protected files](https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-w7wv-vg94-7pvp)
- [GHSA-h5cv-65m7-x97v: Heap disclosure via unchecked clipboard length in Paste Binary](https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-h5cv-65m7-x97v)
- [GHSA-j327-595g-jg4c: Out-of-bounds array index via NPPM_MENUCOMMAND](https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-j327-595g-jg4c)
- [GHSA-554x-h7h6-gqfm: Heap Buffer Overflow and Decompression Bomb in SAML Decode (mimetools)](https://github.com/npp-plugins/mimetools/security/advisories/GHSA-554x-h7h6-gqfm)
- [CVE-2026-48770 (earlier Notepad++ WM_COPYDATA DoS, fixed in 8.9.6.1) - SentinelOne vulnerability database](https://www.sentinelone.com/vulnerability-database/cve-2026-48770/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5612