EN PT-BR
← Voltar ao feed
medium

Notepad++ 8.9.9 fixes six local flaws, including WM_COPYDATA privilege escalation and a MIME Tools heap overflow

1 fonte(s) · 1 atualização(ões) · publicado 10/11/2026 01:48 · coletado há 1 hora

Notepad++ released version 8.9.9 on 2026-11-06 with fixes for six vulnerabilities, and the vendor lists none of them with a CVE ID yet (notepad-plus-plus.org). Five of the flaws sit in the editor itself, and the GitHub advisories for them mark 8.9.8 and earlier as affected (github.com). The sixth is a heap overflow in the SAML decoder of the MIME Tools plugin, which the article says is fixed in 3.2. Every flaw needs local access, such as a process on the same machine or a user who must approve a UAC prompt. The most serious chain is the WM_COPYDATA issue, which becomes local privilege escalation only with the optional NppExec plugin installed and initialized, an already elevated editor and a second instance running from the same path. Four of the GitHub advisories still show no patched version, which contradicts the vendor's 8.9.9 claim, so the vendor release page remains the reference for the fix.

Entenda a falha

A vulnerabilidade

Notepad++ 8.9.8 and earlier has five local flaws, fixed in 8.9.9 (released 2026-11-06), and the MIME Tools plugin has a sixth, fixed in 3.2. None has a CVE yet. The most severe is the WM_COPYDATA sender-authentication bypass (GHSA-5jjv-2h6g-63p5, CVSS 3.1 estimate 7.0, published as Moderate). Chained with an installed and initialized NppExec plugin, an already elevated editor and a second instance running from the same path, it gives code execution at High integrity. The others are a UAC save TOCTOU (6.6), a Paste Binary heap disclosure (5.6), an unchecked NPPM_MENUCOMMAND index that reaches ShellExecute (5.3), and heap overflows in MIME Tools SAML Decode, which can crash the editor and possibly run code. All need local access. They are not network RCE.

Como funciona

For WM_COPYDATA, a message arrives at the Notepad++ window and isSenderTrusted takes the sender window from the caller-supplied wParam, then checks only which process owns that window. A decoy Notepad++ from the same path therefore makes an unrelated sender look trusted, and a spoofed NppExec message can then run a command in an elevated editor. In the UAC save, the editor writes the document to a user-writable %TEMP% file, closes it and hands the path to an elevated helper that copies it with CopyFileW. In that gap, a same-user process can swap the contents. In Paste Binary, the byte count comes from a separate private clipboard format and is used to grow the document without comparing it to the real buffer size, so adjacent heap is copied in.

Por que é vulnerável

The common root is trusting caller- or attacker-controlled values without validation. The sender handle is trusted without proving the process that owns the window actually sent the message. The clipboard length and the menu command index are used without bounds checks. The UAC save leaves a gap between closing the temp file and the elevated copy. In MIME Tools, DEFLATE expansion is unbounded and copies into 200,000-byte buffers are unchecked. The WM_COPYDATA advisory asks that the bypass be triaged as a possible incomplete fix of GHSA-pg39-63h5-cx35. The articles do not describe the exact code changes in 8.9.9.

Onde está

The flaw is in the isSenderTrusted function (WM_COPYDATA, GHSA-5jjv-2h6g-63p5), the CopyFileW-based UAC save path (GHSA-w7wv-vg94-7pvp), the Paste Binary clipboard handling (GHSA-h5cv-65m7-x97v), the ID_USER_CMD and ID_MACRO dispatch of NPPM_MENUCOMMAND (GHSA-j327-595g-jg4c) and the MIME Tools SAML Decode feature. The advisory references commits de0a77ba7f9d0d81f5862f527e8afc2693ce49ff and 67e755f041700d4250c3787efbb8df120e405410.

Como foi descoberta

The articles do not say who found the flaws or when they were reported. They were disclosed through public GitHub advisories and the vendor's 8.9.9 release announcement, which lists all six as fixed without CVE IDs. The advisories read as researcher write-ups with test results. The WM_COPYDATA one is linked to an earlier advisory, GHSA-pg39-63h5-cx35. The advisories for four of the flaws still show no patched version, which contradicts the vendor page. The MIME Tools details come only from a gbhackers.com article, not from the plugin advisory.

PoC existente, privada

O exploit existe, mas quem o tem não o publicou.

The advisories report test demonstrations, not a released exploit. With NppExec 0.8.12.1 in an elevated target, a spoofed message ran a harmless marker command at High integrity. A Paste Binary test with a 3-byte buffer and a declared length of 4096 added 4096 bytes of live heap. An out-of-range menu command reached ShellExecute, but control of the command string was not shown. The UAC TOCTOU did not demonstrate arbitrary destination or code execution. No published exploit code is shown, so urgency is moderate: patch to 8.9.9, but the attack paths are local and conditional.

Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 02:17.

Detalhes técnicos

  • WM_COPYDATA sender authentication bypass (GHSA-5jjv-2h6g-63p5, github.com): isSenderTrusted takes the sender window from caller-controlled wParam and checks only the owner process of that window. A decoy Medium-integrity Notepad++ from the same executable path lets an unrelated process pass the check. The advisory's conservative CVSS 3.1 estimate is 7.0 (AV:L/AC:H/PR:L/UI:N), but GitHub publishes it as Moderate. The advisory calls it conditional local High-integrity code execution and states it is not network RCE.
  • WM_COPYDATA plugin command execution (GHSA-5jjv-2h6g-63p5, github.com): with NppExec 0.8.12.1 installed and initialized in an elevated target, a spoofed NppExecScript= message ran a harmless marker command in the High-integrity context. The advisory treats NppExec as the impact sink and the core check as the primary flaw.
  • UAC save TOCTOU (GHSA-w7wv-vg94-7pvp, github.com): Notepad++ 8.9.8 writes the document to a user-writable %TEMP% file, closes it, and passes its path to an elevated helper that copies it with CopyFileW. A same-user process can swap the contents after the close and before the copy, so attacker bytes land in the user-selected protected destination after UAC approval. The advisory did not test arbitrary destination redirection or code execution. CVSS 3.1 is 6.6 (AV:L/AC:L/PR:L/UI:R), rated Moderate.
  • Heap disclosure in Paste Binary (GHSA-h5cv-65m7-x97v, github.com): the byte count comes from a separate private clipboard format and is trusted without checking the real buffer size. In the advisory's test, a 3-byte buffer with a declared length of 4096 grew the document by 4096 bytes, and the extra bytes contained live process heap. The Clipboard History panel reaches the same unchecked length automatically when open, but the advisory did not reproduce that path. Affected versions are 8.9.8 and earlier, rated Moderate at 5.6.
  • Out-of-bounds index via NPPM_MENUCOMMAND (GHSA-j327-595g-jg4c, github.com): the ID_USER_CMD and ID_MACRO dispatch uses an unchecked index into vectors that are empty on a default installation. In the advisory's test, an out-of-range command reached ShellExecute without user interaction. The advisory did not demonstrate control of the command string. Affected versions are 8.9.8 and earlier, rated Moderate at 5.3.
  • MIME Tools SAML decode (gbhackers.com, not verified against the plugin advisory): the article reports heap overflows from unbounded DEFLATE expansion and unchecked copies into 200,000-byte buffers, causing crashes and possible code execution, with versions through 3.1 affected and 3.2 fixed. The MIME Tools advisory (github.com/npp-plugins/mimetools) was not retrieved, so these version bounds rest on the article alone.

Remediação

  • Install Notepad++ 8.9.9 from the vendor download page (notepad-plus-plus.org/downloads/v8.9.9), which gives the release date 2026-11-06 and publishes SHA-256 digests and GPG signatures.
  • Update the MIME Tools plugin to 3.2, as the article advises; this was not confirmed against the plugin's own advisory.
  • Until updated, avoid running Notepad++ elevated, and review or remove NppExec and other installed plugins.
  • Do not treat the GitHub advisory 'Patched versions: None' field as proof that a fix is missing. The GitHub releases page was not retrieved, so the release-level confirmation is limited to the vendor announcement and download page.
  • The WM_COPYDATA advisory asks that the bypass be triaged as a possible incomplete fix of GHSA-pg39-63h5-cx35 and references commits de0a77ba7f9d0d81f5862f527e8afc2693ce49ff and 67e755f041700d4250c3787efbb8df120e405410 (github.com). Those commits were not opened, so no Fix Details section is given.

Relatos divergentes

  • The article says the release announcement identifies 8.9.9 as the corrective update, but the GitHub advisories GHSA-5jjv-2h6g-63p5, GHSA-w7wv-vg94-7pvp, GHSA-h5cv-65m7-x97v and GHSA-j327-595g-jg4c each show 'Patched versions: None' (github.com). The vendor release page lists all six as fixed in 8.9.9 (notepad-plus-plus.org), so the vendor is more authoritative on the fixed version and the advisory metadata appears outdated.
  • The article's headline frames the release as privilege escalation and command execution. The GitHub advisories it draws on rate the four core flaws Moderate, at CVSS 5.3 to 7.0, and each depends on local access and additional conditions (github.com).
  • The vendor release links its first item to GHSA-pg39-63h5-cx35, which describes a low-integrity process forcing Notepad++ to open an attacker-chosen file (github.com). The article's description of the handle-trust bypass matches GHSA-5jjv-2h6g-63p5 instead, so the two advisories should be tracked separately.

Linha do tempo

  1. gbhackers.com ↗ · pub. 10/11/2026 01:48 · coletado 10/11 02:00 primeiro registro

    Notepad++ 8.9.9 fixes six local flaws, including WM_COPYDATA privilege escalation and a MIME Tools heap overflow

    ler a análise desta fonte

    Notepad++ released version 8.9.9 on 2026-11-06 with fixes for six vulnerabilities, and the vendor lists none of them with a CVE ID yet (notepad-plus-plus.org). Five of the flaws sit in the editor itself, and the GitHub advisories for them mark 8.9.8 and earlier as affected (github.com). The sixth is a heap overflow in the SAML decoder of the MIME Tools plugin, which the article says is fixed in 3.2. Every flaw needs local access, such as a process on the same machine or a user who must approve a UAC prompt. The most serious chain is the WM_COPYDATA issue, which becomes local privilege escalation only with the optional NppExec plugin installed and initialized, an already elevated editor and a second instance running from the same path. Four of the GitHub advisories still show no patched version, which contradicts the vendor's 8.9.9 claim, so the vendor release page remains the reference for the fix.

    Technical Details

    • WM_COPYDATA sender authentication bypass (GHSA-5jjv-2h6g-63p5, github.com): isSenderTrusted takes the sender window from caller-controlled wParam and checks only the owner process of that window. A decoy Medium-integrity Notepad++ from the same executable path lets an unrelated process pass the check. The advisory's conservative CVSS 3.1 estimate is 7.0 (AV:L/AC:H/PR:L/UI:N), but GitHub publishes it as Moderate. The advisory calls it conditional local High-integrity code execution and states it is not network RCE.
    • WM_COPYDATA plugin command execution (GHSA-5jjv-2h6g-63p5, github.com): with NppExec 0.8.12.1 installed and initialized in an elevated target, a spoofed NppExecScript= message ran a harmless marker command in the High-integrity context. The advisory treats NppExec as the impact sink and the core check as the primary flaw.
    • UAC save TOCTOU (GHSA-w7wv-vg94-7pvp, github.com): Notepad++ 8.9.8 writes the document to a user-writable %TEMP% file, closes it, and passes its path to an elevated helper that copies it with CopyFileW. A same-user process can swap the contents after the close and before the copy, so attacker bytes land in the user-selected protected destination after UAC approval. The advisory did not test arbitrary destination redirection or code execution. CVSS 3.1 is 6.6 (AV:L/AC:L/PR:L/UI:R), rated Moderate.
    • Heap disclosure in Paste Binary (GHSA-h5cv-65m7-x97v, github.com): the byte count comes from a separate private clipboard format and is trusted without checking the real buffer size. In the advisory's test, a 3-byte buffer with a declared length of 4096 grew the document by 4096 bytes, and the extra bytes contained live process heap. The Clipboard History panel reaches the same unchecked length automatically when open, but the advisory did not reproduce that path. Affected versions are 8.9.8 and earlier, rated Moderate at 5.6.
    • Out-of-bounds index via NPPM_MENUCOMMAND (GHSA-j327-595g-jg4c, github.com): the ID_USER_CMD and ID_MACRO dispatch uses an unchecked index into vectors that are empty on a default installation. In the advisory's test, an out-of-range command reached ShellExecute without user interaction. The advisory did not demonstrate control of the command string. Affected versions are 8.9.8 and earlier, rated Moderate at 5.3.
    • MIME Tools SAML decode (gbhackers.com, not verified against the plugin advisory): the article reports heap overflows from unbounded DEFLATE expansion and unchecked copies into 200,000-byte buffers, causing crashes and possible code execution, with versions through 3.1 affected and 3.2 fixed. The MIME Tools advisory (github.com/npp-plugins/mimetools) was not retrieved, so these version bounds rest on the article alone.

    Remediation

    • Install Notepad++ 8.9.9 from the vendor download page (notepad-plus-plus.org/downloads/v8.9.9), which gives the release date 2026-11-06 and publishes SHA-256 digests and GPG signatures.
    • Update the MIME Tools plugin to 3.2, as the article advises; this was not confirmed against the plugin's own advisory.
    • Until updated, avoid running Notepad++ elevated, and review or remove NppExec and other installed plugins.
    • Do not treat the GitHub advisory 'Patched versions: None' field as proof that a fix is missing. The GitHub releases page was not retrieved, so the release-level confirmation is limited to the vendor announcement and download page.
    • The WM_COPYDATA advisory asks that the bypass be triaged as a possible incomplete fix of GHSA-pg39-63h5-cx35 and references commits de0a77ba7f9d0d81f5862f527e8afc2693ce49ff and 67e755f041700d4250c3787efbb8df120e405410 (github.com). Those commits were not opened, so no Fix Details section is given.

    Conflicting Reports

    • The article says the release announcement identifies 8.9.9 as the corrective update, but the GitHub advisories GHSA-5jjv-2h6g-63p5, GHSA-w7wv-vg94-7pvp, GHSA-h5cv-65m7-x97v and GHSA-j327-595g-jg4c each show 'Patched versions: None' (github.com). The vendor release page lists all six as fixed in 8.9.9 (notepad-plus-plus.org), so the vendor is more authoritative on the fixed version and the advisory metadata appears outdated.
    • The article's headline frames the release as privilege escalation and command execution. The GitHub advisories it draws on rate the four core flaws Moderate, at CVSS 5.3 to 7.0, and each depends on local access and additional conditions (github.com).
    • The vendor release links its first item to GHSA-pg39-63h5-cx35, which describes a low-integrity process forcing Notepad++ to open an attacker-chosen file (github.com). The article's description of the handle-trust bypass matches GHSA-5jjv-2h6g-63p5 instead, so the two advisories should be tracked separately.