Notepad++ 8.9.9 fixes six flaws, worst in the MIME Tools SAML decoder

Notepad++ 8.9.9 fixes six flaws, worst in the MIME Tools SAML decoder

9 November 2026: Notepad++ 8.9.9, released on 6 November, fixes six vulnerabilities, the most serious a heap buffer overflow in the MIME Tools plugin's SAML decoder that could lead to code execution when a user decodes a malicious payload. No exploitation has been reported and no CVE numbers exist yet, so vulnerability scanners may not flag unpatched copies.

Not yet independently verified. The project had assigned no CVE numbers when this was read on 9 November 2026. Its GitHub advisories still show "Patched versions: None" for the editor issues, while the release note says all six are fixed in 8.9.9. We will update this when it can be confirmed, and remove this note.

A plugin bug with the highest rating

MIME Tools advisory GHSA-554x-h7h6-gqfm, rated High, covers versions up to and including 3.1, with 3.2 as the fix. The SAML Decode function writes into an output buffer of a fixed 200,000 bytes, and a crafted Base64 or DEFLATE-compressed payload can write past it. The advisory also lists a decompression bomb, and gives remote code execution or denial of service as the possible impact.

The trigger requires a person to decode the payload, which makes the likely targets those who paste SAML assertions into an editor as part of their work: identity engineers and support staff debugging single sign-on. The pages we read do not state that plugin version 3.2 ships inside the 8.9.9 installer, so it is worth checking the version under the Plugins menu after updating.

Five issues on the editor itself

The release note lists a WM_COPYDATA sender authentication bypass, a WM_COPYDATA privilege escalation allowing plugin commands to be launched, a time-of-check to time-of-use risk when saving a temporary file under UAC, a heap disclosure, and an out-of-bounds array access through NPPM_MENUCOMMAND.

These concern what another program on the same machine can make Notepad++ do, and they matter most where the editor runs elevated. The sender bypass advisory describes conditional execution at High integrity through the NppExec plugin. The UAC advisory describes swapping content into a protected file during a save.

heise gives CVSS scores of 6.6 for the UAC issue, 5.6 for the heap disclosure and 5.3 for both the window message privilege issue and the menu command issue, and none for the sender bypass. The project's advisories for the editor that we read rate those issues Moderate.

What administrators need to do

Move to 8.9.9, which is offered as x64, arm64, MSI and portable builds, with SHA256 digests on the GitHub release. Fleets that deploy Notepad++ through a software catalogue should push the MSI and not wait for a scanner to pick it up, since detection rules usually follow a CVE number. Portable copies on developer machines will be missed by most inventories.

Staff who have reason to run the editor as administrator should stop doing so until they have updated, as that is the condition under which the local issues do the most damage.

Besides the fixes, 8.9.9 brings faster search in files and updates the Scintilla component to 5.6.9. The project keeps a thread for regressions and critical bugs in this release on its community forum.

Notepad++ is listed with us among 38 application development tools, alongside Sublime Text.

Sources

• Notepad++: v8.9.9 release, 6 November 2026
• GitHub: Notepad++ release v8.9.9, 6 November 2026
• heise: Notepad++ update closes privilege escalation hole, 9 November 2026