Notepad++ · Disclosed

[Single source] Notepad++ 8.9.9 fixes six privilege escalation and execution flaws

Nov 09, 2026 · 1 min read

Notepad++ released version 8.9.9 fixing six vulnerabilities in Windows message handling, memory management, and plugin functionality. The flaws include plugin command execution by a local attacker through an elevated instance, heap memory disclosure, out-of-bounds access, and a buffer overflow in the MIME Tools plugin. None of the six have assigned CVE identifiers; update to 8.9.9 and the MIME Tools plugin to 3.2.

By HIFY Radar newsroom Updated 11/09/2026 02:44 PM Get this every day →← Back to the feed 1 source

HighVulnerabilityDisclosedPatched

In 30 seconds

Observed

Notepad++ has released version 8.9.9 to fix six security vulnerabilities, according to a post by security-focused account DarkWebInformer. The flaws affect Windows message handling, memory management, and plugin functionality, and include a scenario in which a local attacker could execute plugin commands through an elevated Notepad++ instance, plus heap memory disclosure, out-of-bounds access, and a buffer overflow in the MIME Tools plugin. None of the six vulnerabilities currently have assigned CVE identifiers. Users are advised to update to 8.9.9 and to update the MIME Tools plugin to version 3.2.

What happened

Observed

According to the report, Notepad++ shipped version 8.9.9 to address six security vulnerabilities affecting Windows message handling, memory management, and plugin functionality.

Alleged

The reported flaw set includes one issue that could allow a local attacker to execute plugin commands through an elevated Notepad++ instance under specific conditions: a privilege escalation vector: as well as heap memory disclosure, an out-of-bounds access flaw, and a buffer overflow in the MIME Tools plugin that could potentially lead to code execution.

Why it matters

Inferred

If confirmed, these flaws matter because Notepad++ is widely deployed on Windows, and a privilege escalation path through an elevated editor instance could allow a local attacker to run commands with higher privileges; the MIME Tools buffer overflow could additionally open a path to code execution.

Inferred

Because none of the six vulnerabilities have CVE identifiers yet, organizations that track patching through CVE feeds may not surface these fixes, raising the risk of delayed updates.

What to do

Observed

Update Notepad++ to version 8.9.9, which contains the fixes for all six reported vulnerabilities.

Observed

Ensure the MIME Tools plugin is updated to version 3.2, since one of the fixed flaws: a buffer overflow with potential code execution impact: resides in that plugin.

Confirmed and still uncertain

Observed

Known, from the single available report: six vulnerabilities were fixed in Notepad++ 8.9.9, spanning Windows message handling, memory management, and plugin functionality; no CVE identifiers have been assigned; and the MIME Tools plugin fix lands in version 3.2.

Inferred

Unknown from the current evidence batch: confirmation from an official Notepad++ advisory or changelog, technical details or proof-of-concept code, severity scores, which prior versions are affected, and whether any of the flaws have been exploited in the wild.

What people are saying

Observed

The only voice in the evidence batch is DarkWebInformer, an X account focused on vulnerability and cybercrime news, which framed the release as fixing 'six security vulnerabilities that could allow privilege escalation and code execution' and urged users to update to 8.9.9 with MIME Tools at 3.2.

Evolution

Inferred

The evidence batch contains a single post published on November 9, 2026; there is no prior coverage, disclosure timeline, vendor statement, or follow-up in the batch, so how this story develops: including possible CVE assignments: cannot yet be traced.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Observed

The reported scope of the six fixes covers three areas of the application: Windows message handling, memory management, and plugin functionality.

Alleged

Specific reported flaw types: a local privilege escalation path in which plugin commands could be executed through an elevated Notepad++ instance under specific conditions; heap memory disclosure; out-of-bounds access; and a buffer overflow in the MIME Tools plugin with potential code execution impact.

Observed

No CVE identifiers had been assigned to any of the six vulnerabilities at the time of the report.

Sources and evidence

Observed

This story rests on a single unverified source: an X post by DarkWebInformer (https://x.com/DarkWebInformer/status/2119847950532616371), published November 9, 2026, reporting the Notepad++ 8.9.9 security release.

Inferred

No vendor advisory, changelog, CVE record, or independent second source appears in the batch; the flaw count and impact claims should be treated as single-source until corroborated by official Notepad++ channels.