CVE-2026-48770PoC(notepad-plus-plus / notepad\+\+)

HIGHCVSS 5.0 · MEDIUM

Exploitation ongoing with high activity in latest observed window (3 mentions)

Immediate actions

Patch notepad-plus-plus notepad\+\+ systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, a local process in the same interactive Windows session can send a malformed WM_COPYDATA message to Notepad++ using the COPYDATA_FULL_CMDLINE path. The handler appears to process COPYDATASTRUCT.lpData as an unbounded NUL-terminated wchar_t* instead of enforcing COPYDATASTRUCT.cbData. This vulnerability is fixed in 8.9.6.1.

notepad-plus-plus CVEs Back to dashboard

7.5/ 10 priority

Sources & remediation

Patch / fix

Exploit / PoC references

Weakness type (CWE)

CWE-125

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

notepad\+\+

Threat summary

Active exploitation appears in 1 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
10 mentions across 5 observed days

What's happening

Active exploitation reported across 1 signal
Exploit tool or code specified in 2 signals
PoC mentioned or linked in 4 signals
Patch or workaround mentioned in 4 signals
Technical details provided in 6 signals
Disclosure: 3 classified signals
Peaked 4d ago at 3 mentions (2026-05-28); latest day: 3
10 total mentions across 5 days

Affected systems

Vendors

notepad-plus-plus

Products

notepad\+\+

Deep dive

Activity timeline10 mentions / 5d

Signal classification4 categories

PoC

440.0%

Disclosure

330.0%

Patch

220.0%

Active Exploitation

110.0%

Referenced assets8 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-28	3	Patch2PoC1
2026-05-29	1	PoC1
2026-05-30	2	PoC2
2026-06-01	1	Active Exploitation1
2026-06-27	3	Disclosure3

Full discourse10 posts

NullSecurityX@NullSecurityX134d
PoC
Wrote PoCs for three Notepad++ vulnerabilities (CVE-2026-48770/48778/48800) patched stood out both are RCE via config file injection. Notepad++ passes commandLineInterpreter (config.xml) and UserDefinedCommands (shortcuts.xml) directly to ShellExecute() without any validation. https://t.co/aLwMpHHSw4
Post summary
The tweet reports that Proof of Concepts were created for three Notepad++ RCE vulnerabilities (CVE‑2026‑48770/48778/48800) and that the issues have been patched, providing technical details about the exploitation vector.
3181107375.5K
12.3K followersView on X
إبراهيم بوحيمد | Ibrahim Buhaimed@buhaimedi136d
Patch
🚨 اذا انت من الجيل القديم ولاتزال تستخدم Notepad++ حدّث البرنامج فوراً إلى الإصدار الأخير (v8.9.6.1). 📍 الثغرة الأولى: (CVE-2026-48770) 📍 الثغرة الثانية: (CVE-2026-48778) 📍 الثغرة الثالثة: (CVE-2026-48800) https://t.co/Ke5sL7bgAl
Post summary
The tweet urges users to upgrade Notepad++ to version 8.9.6.1 because of three CVEs, providing a link for more information.
34043275.0K
50.0K followersView on X
blueblue@piedpiper1616135d
PoC
GitHub - atiilla/Notepad-8.9.6-PoC: Proof-of-concept scripts for three vulnerabilities in Notepad++ <= 8.9.6, patched in v8.9.6.1 (2026-05-26) CVE-2026-48770 / CVE-2026-48778 / CVE-2026-48800 · GitHub - https://github.com/atiilla/Notepad-8.9.6-PoC
Post summary
A GitHub repo hosts proof‑of‑concept scripts for three Notepad++ vulnerabilities (CVE‑2026‑48770, ‑48778, ‑48800) that were fixed in version 8.9.6.1; there is no evidence of active exploitation or detailed technical data.
01091718
5.5K followersView on X
Hacking Space 📡@hackingspace136d
PoC
Notepad++ <= 8.9.6 Multiple Vulnerabilities (CVE-2026-48770, CVE-2026-48778, CVE-2026-48800) poc: https://github.com/intelseclab/poc-archive/tree/master/pocs/binary/2026-05-28_notepad-plus-plus-8-9-6-multi-cve https://t.co/Et7ZKIEN5v
Post summary
The post announces three new Notepad++ CVEs and shares a link to a PoC, but provides no exploitation details, patch info, or evidence of active attacks.
00043413
7.1K followersView on X
ThreatCluster@threatcluster137d
Patch
BREAKING: Notepad++ 8.9.6.1 patches three critical bugs (CVE-2026-48770, -48778, -48800) that allow remote code execution via config file handling, users on 8.9.6 and below urged to update. https://threatcluster.io/cluster/critical-notepad-vulnerabilities-enable-remote-code-executio-6725f42a
Post summary
Notepad++ releases a patch for three CVEs that allow remote code execution; users with older versions are urged to update immediately.
0001186
279 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds107d
Disclosure
CVE-2026-48770 Local Privilege Escalation in Notepad++ Prior to 8.9.6.1 via WM_COPYDATA https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-48770
Post summary
The passage identifies a local privilege escalation vulnerability in Notepad++ versions before 8.9.6.1 that can be triggered via WM_COPYDATA, with a link to a detailed vulnerability report.
00000118
4.1K followersView on X
Infoflowcloud@infoflowcloud107d
Disclosure
🚨*CVE* CVE-2026-48770 Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, a local process in the same interactive Windows session can send a malformed WM_COPYDATA mes… https://www.cve.org/CVERecord?id=CVE-2026-48770 ----- Traducción: CVE-2026-48770 Not… http://infoflow.cloud`
Post summary
The tweet cites CVE-2026-48770, noting that a local process in the same interactive Windows session can send a malformed WM_COPYDATA message, but it provides no PoC, exploit code, patch details, or evidence of in‑the‑wild activity.
0000039
89 followersView on X
CVE@CVEnew107d
Disclosure
CVE-2026-48770 Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, a local process in the same interactive Windows session can send a malformed WM_COPYDATA mes… https://www.cve.org/CVERecord?id=CVE-2026-48770
Post summary
The post highlights a local-exploitation vulnerability (CVE‑2026‑48770) in Notepad++ involving malformed WM_COPYDATA messages, but provides no PoC, exploit code, or patch details.
00000866
57.7K followersView on X
VulDB 🛡@vuldb133d
Active Exploitation
It is possible to see elevated activities targeting Notepad++ (CVE-2026-48770) https://vuldb.com/vuln/367177/cti
Post summary
The post reports observed heightened activity against Notepad++ linked to CVE-2026-48770, indicating possible in‑the‑wild exploitation, while providing no proof‑of‑concept, exploit code, or patch information.
0000088
2.2K followersView on X
Hephaestvs@Vulcanux_136d
PoC
csirt_it: ‼️ #Notepad++: disponibili #PoC per le CVE-2026-48800, CVE-2026-48778 e CVE-2026-48770 che interessano il noto editor di testo Rischio: 🔴 Tipologia: 🔸 Arbitrary Code Execution 🔸 Denial of Service 🔗 https://www.acn.gov.it/portale/w/notepad-poc-pubblici-per-le-cve-2026-48800-cve-2026-48778-e-cve-2026-48770 🔄 Aggiorname… https://t.co/siCgHZVjb5
Post summary
Proof‑of‑concept exploits for three Notepad++ CVEs (2026‑48800, 2026‑48778, 2026‑48770) are publicly available and outlined as Arbitrary Code Execution and Denial of Service, but no active exploitation, patches, or detailed exploit tools are reported.
0000063
614 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	notepad-plus-plus	notepad\+\+	-	-	-

Explore more

Back to dashboard notepad-plus-plus CVEs notepad\+\+ vulnerabilities

What researchers are saying

CVE-2026-48770

NullSecurityX[verified]@NullSecurityXPoC

The tweet reports that Proof of Concepts were created for three Notepad++ RCE vulnerabilities (CVE‑2026‑48770/48778/48800) and that the issues have been patched, providing technical details about the exploitation vector.

إبراهيم بوحيمد | Ibrahim Buhaimed[verified]@buhaimediPatch

The tweet urges users to upgrade Notepad++ to version 8.9.6.1 because of three CVEs, providing a link for more information.

ThreatCluster[verified]@threatclusterPatch

Notepad++ releases a patch for three CVEs that allow remote code execution; users with older versions are urged to update immediately.

blueblue@piedpiper1616PoC

A GitHub repo hosts proof‑of‑concept scripts for three Notepad++ vulnerabilities (CVE‑2026‑48770, ‑48778, ‑48800) that were fixed in version 8.9.6.1; there is no evidence of active exploitation or detailed technical data.

Hacking Space 📡@hackingspacePoC

The post announces three new Notepad++ CVEs and shares a link to a PoC, but provides no exploitation details, patch info, or evidence of active attacks.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The passage identifies a local privilege escalation vulnerability in Notepad++ versions before 8.9.6.1 that can be triggered via WM_COPYDATA, with a link to a detailed vulnerability report.

Infoflowcloud@infoflowcloudDisclosure

The tweet cites CVE-2026-48770, noting that a local process in the same interactive Windows session can send a malformed WM_COPYDATA message, but it provides no PoC, exploit code, patch details, or evidence of in‑the‑wild activity.

CVE@CVEnewDisclosure

The post highlights a local-exploitation vulnerability (CVE‑2026‑48770) in Notepad++ involving malformed WM_COPYDATA messages, but provides no PoC, exploit code, or patch details.