Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the NPPM_SAVESESSION handler in PowerEditor/src/NppBigSwitch.cpp converts lParam to a sessionInfo pointer and dereferences its nbFile, files, and sessionFilePathName members without checking for null. A process running at the same or a higher Windows integrity level on the same desktop can send NPPM_SAVESESSION with a null lParam, immediately terminating Notepad++ and causing denial of service and loss of unsaved documents.
This issue is fixed in version 8.9.8.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
notepad-plus-plus:notepad-plus-plus
References 4
https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA…
https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-j85c-6wc9-p98p
https://github.com/notepad-plus-plus/notepad-plus-plus/commit/8b33f52e7aa488b12…
https://github.com/notepad-plus-plus/notepad-plus-plus/commit/8b33f52e7aa488b1222d3cfce5903a38dd63101f
https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.8
https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.8
https://notepad-plus-plus.org/news/v898-released
https://notepad-plus-plus.org/news/v898-released