Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L L L R U N N H 5.0 .0026 17.7 —
AFFECTED Product Versions Fixed notepad-plus-plus < 8.9.6.1 – —
TIMELINE May 22 Reserved by GitHub_M Jun 26 EXPLOIT PUBLISHED — CVE-2026-48770 (notepad-plus-plus). Public exploit reference added. Jun 26 Published (CNA: GitHub_M)
Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, a local process in the same interactive Windows session can send a malformed WM_COPYDATA message to Notepad++ using the COPYDATA_FULL_CMDLINE path. The handler appears to process COPYDATASTRUCT.lpData as an unbounded NUL-terminated wchar_t* instead of enforcing COPYDATASTRUCT.cbData. This vulnerability is fixed in 8.9.6.1.
| Date | Event | Detail |
|---|---|---|
| May 22, 2026 | Reserved | Reserved by GitHub_M |
| June 26, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-48770 (notepad-plus-plus). Public exploit reference added. |
| June 26, 2026 | Published | Published (CNA: GitHub_M) |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| notepad-plus-plus | notepad-plus-plus | — | < 8.9.6.1 | — |
Authoritative record: CVE-2026-48770 at cve.org
Vendors: notepad-plus-plus
Weaknesses: CWE-125
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-48770 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.