Notepad++ 8.9.9 Patches Six Vulnerabilities, Including Plugin Command Execution
Notepad++ version 8.9.9 addresses six security flaws, with a critical vulnerability allowing local attackers to execute plugin commands under specific conditions.
Notepad++ has released version 8.9.9, a security-focused update that rectifies six vulnerabilities discovered across various components of the popular text editor. These flaws impact Windows message handling, protected file saving mechanisms, clipboard operations, and the MIME Tools plugin, addressing potential risks ranging from information disclosure to command execution.
The most significant vulnerability patched is a flaw in how Notepad++ handles the WM_COPYDATA Windows message. In version 8.9.8, the application did not sufficiently validate the sender of this message, allowing a local attacker to nominate a separate, legitimate Notepad++ window to pass security checks. This could enable an attacker to inject plugin commands into an elevated editor instance, potentially leading to privilege escalation. However, successful exploitation of this specific flaw required the NppExec plugin to be installed and initialized, along with a second Notepad++ instance running from the same executable path, making it a conditional local privilege escalation rather than a remote code execution vulnerability.
Beyond the WM_COPYDATA issue, the update also addresses a separate sender authentication bypass related to the same message type, further highlighting the risks associated with trusting caller-controlled data across privilege boundaries. This vulnerability underscores the importance of robust validation when inter-process communication is involved, especially when dealing with sensitive operations.
Other vulnerabilities patched include a heap memory disclosure flaw in the "Paste Binary" function. An unchecked clipboard length allowed a local process to supply a small text buffer alongside a larger claimed size, causing Notepad++ to copy adjacent process memory into the document. This could expose sensitive information residing in the editor's heap.
The MIME Tools plugin, specifically versions up to 3.1, contained buffer overflows in its SAML Decode functionality. Crafted input could lead to crashes or potentially code execution when decoded. Version 3.2 of the MIME Tools plugin has been released to address this specific issue.
Additionally, the update fixes a vulnerability related to saving protected files that require User Account Control (UAC) approval. In the previous version, Notepad++ wrote document contents to a temporary file, closed it, and then passed the path to an elevated helper process. A malicious process could replace the temporary file's contents before the helper copied them, potentially altering the saved file.
Users are strongly advised to update to Notepad++ version 8.9.9 immediately to mitigate these security risks. The update can be downloaded from the official Notepad++ website. While no specific CVE identifiers were assigned to these vulnerabilities in the release notes, their nature warrants prompt attention from all users, especially those operating in environments where local privilege escalation or data exposure could have significant consequences.
The release notes also mention improvements to Find in Files performance, updates to Scintilla and Lexilla, new dialog font controls, and fixes for clipboard history errors and memory leaks, indicating a comprehensive maintenance release.