ALT: Anime Girl Writing in Notepad

Mit dem Update auf Notepad++ 8.9.9 bessert Don Ho sechs Schwachstellen aus. Es gibt aber auch Verbesserungen etwa in der Performance.

Notepad++ released version 8.9.9 on November 6, 2026, fixing six security flaws across Windows message handling, protected file saving, clipboard operations, and MIME Tools decoding. The update addresses flaws including conditional plugin command execution, memory exposure, and buffer overflow. The release notes list no assigned CVE identifiers for these issues. The command execution issue involves WM_COPYDATA, a Windows message used to exchange data between applications. In Notepad++ 8.9.8, the sender checks whether a window handle supplied by the caller is trusted rather than proving which process sent the message. A local attacker could nominate a separate, legitimate Notepad++ window to pass those checks. This could let an attacker pass plugin commands into an elevated editor. However, the demonstrated attack required the optional NppExec plugin to be installed and initialized, an already elevated target, and a second Notepad++ instance running from the same executable path. It is local privilege escalation under specific conditions, not network-based remote code execution. The release separately lists a WM_COPYDATA sender authentication bypass and the plugin command execution flaw. Both highlight the danger of trusting caller-controlled message data across privilege levels. The update follows earlier Notepad++ code execution fixes involving configuration files, although those earlier vulnerabilities have different causes. Another flaw affects saves that require User Account Control approval. Notepad++ wrote document contents into a temporary file, closed it, and passed its path to an elevated helper. A malicious process running as the same user could replace those contents before the helper copied them into the protected file selected by the user. User approval remained necessary. Memory Flaws and Plugin Risks The heap disclosure advisory describes an unchecked clipboard length in Paste Binary. A local process could supply a small text buffer alongside a larger claimed size, causing Notepad++ to copy adjacent process memory into a document. Testing recovered heap data beyond the supplied buffer. The NPPM_MENUCOMMAND flaw used unchecked indexes when selecting stored commands. Testing showed out-of-bounds data reaching ShellExecute and blocking the interface, but attacker control over the resulting command was not demonstrated. Separately, MIME Tools versions through 3.1 contain SAML Decode buffer overflows. Crafted input could crash the editor or potentially execute code when decoded. MIME Tools 3.2 fixes that issue. Earlier Notepad++ plugin abuse involved replaced plugin files, a different attack path from these newly patched flaws. Users should install version 8.9.9 through the official download page and verify MIME Tools is updated. The release also improves Find in Files performance, refreshes Scintilla and Lexilla, adds dialog font controls, and fixes clipboard history errors and memory leaks. Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs . The post Notepad++ 8.9.9 Released With Fixes for 6 Vulnerabilities Allowing Plugin Command Execution appeared first on Cyber Security News .