Repository navigation
Security: notepad-plus-plus/notepad-plus-plus
Security
No security policy detected
This project has not set up a SECURITY.md file yet.
Report a vulnerability-
Missing validation in public NPPM message handlers causes deterministic local crashesGHSA-8wmf-7r8c-wf2w published
Sep 24, 2026 by donhoLow -
Notepad++ 8.9.8 local denial of service, an unbounded wcscpy_s on the selection terminates the process via fastfailGHSA-3hx4-x297-6752 published
Sep 24, 2026 by donhoModerate -
Out-of-bounds pointer store in Function List when overrideMap.xml contains an oversized langIDGHSA-9rr8-6vjg-gj52 published
Sep 24, 2026 by donhoModerate -
Incomplete fix in v8.9.8 for the UNC warning re-enables silent NTLM forced-authenticationGHSA-gr8w-74qx-pc2v published
Sep 24, 2026 by donhoModerate -
#UAC-SAVE# and related CLI ops copy/move/create with no caller check; UAC Yes still requiredGHSA-phqq-x4c2-7c2q published
Sep 24, 2026 by donhoModerate -
Notepad++ 8.9.7 MSI allows install-path injection into RunOnce PowerShellGHSA-97rx-3h53-4cfj published
Aug 24, 2026 by donhoHigh -
NTLM Hash Leak via FileBrowser Root UNC Path Bypass in Session FilesGHSA-fw3m-3qpq-pvr8 published
Aug 24, 2026 by donhoModerate -
Zero-Click Local Privilege Escalation via WM_COMMANDGHSA-grw6-cw7j-3qfg published
Aug 24, 2026 by donhoHigh -
Notepad++ Crafted UTF-16 File Causes Heap Buffer OverflowGHSA-8jjh-4rq6-r2h8 published
Aug 24, 2026 by donhoHigh -
WinGup (Notepad++ Updater) downloads installer local privilege escalation via TOCTOUGHSA-hrvm-8rjc-v44x published
Aug 24, 2026 by donhoHigh
Learn more about advisories related to notepad-plus-plus/notepad-plus-plus in the GitHub Advisory Database