What is CVE-2026-48770?

CVE-2026-48770 is a medium-severity vulnerability in Notepad-plus-plus, classified under Out-of-bounds Read. CVSS score: 5.0/10. Published 2026-06-26.

How severe is CVE-2026-48770?

Medium severity. CVSS v3 base score is 5.0 out of 10.

Out-of-bounds Read in Notepad-plus-plus

CVE-2026-48770

Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, a local process in the same interactive Windows session can send a malformed WM_COPYDATA message to Notepad++ using the COPYDATA_FULL_CMDLINE path. The handler appea…

Vulnerability class: Buffer Overflow

CVSS v3 metric

CVSS v3 base score 5.0 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H.

Affected products

Notepad-plus-plus — versions < 8.9.6.1

Weakness classification (CWE)

CWE-125 — Out-of-bounds Read

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2026-48770?: CVE-2026-48770 is a medium-severity vulnerability in Notepad-plus-plus, classified under Out-of-bounds Read. CVSS score: 5.0/10. Published 2026-06-26.
How severe is CVE-2026-48770?: Medium severity. CVSS v3 base score is 5.0 out of 10.