SecBoard
Zurück zur CVE-Übersicht

CVE-2026-86056

MEDIUM(5.5)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Risk Signal Score14/100 — NIEDRIG
  • CVSS 5.5 — Mittel

EPSS-Score

0.2%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

5.5

Technische Schwere

Beschreibung

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the NPPM_SAVESESSION handler in PowerEditor/src/NppBigSwitch.cpp converts lParam to a sessionInfo pointer and dereferences its nbFile, files, and sessionFilePathName members without checking for null. A process running at the same or a higher Windows integrity level on the same desktop can send NPPM_SAVESESSION with a null lParam, immediately terminating Notepad++ and causing denial of service and loss of unsaved documents. This issue is fixed in version 8.9.8.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 8.9.8

Threat-Hunting-Queries

Detection of inter-process communication (IPC) sending specific messages to Notepad++ processes. This requires monitoring Windows messages, which is typically done via advanced endpoint detection and response (EDR) solutions or custom instrumentation.

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName == "notepad++.exe"
| where InitiatingProcessFileName != "notepad++.exe" // Exclude self-initiated messages
| where ProcessCommandLine contains "NPPM_SAVESESSION" // Placeholder for actual message monitoring
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, ProcessId

Splunk SPL

index=windows_events EventCode=??? (ProcessName="notepad++.exe" OR TargetProcessName="notepad++.exe") (Message="NPPM_SAVESESSION" OR Description="NPPM_SAVESESSION") | table _time, host, ProcessName, TargetProcessName, Message, Description

Sigma

title: Notepad++ NPPM_SAVESESSION DoS Attempt
status: experimental
description: Detects attempts to crash Notepad++ via NPPM_SAVESESSION message handler with null lParam.
author: SecBoard
date: 2026/08/23
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\notepad++.exe'
    ParentImage|endswith: '\notepad++.exe' # Exclude self-initiated messages, adjust if IPC is from same process
    CommandLine|contains: 'NPPM_SAVESESSION' # Placeholder, actual IPC monitoring needed
  condition: selection
level: medium

Elastic ES|QL

FROM process
WHERE process.executable.name == "notepad++.exe"
AND NOT process.parent.executable.name == "notepad++.exe"
AND process.args LIKE "*NPPM_SAVESESSION*" // Placeholder for actual message monitoring
SELECT @timestamp, host.name, process.parent.executable.name, process.parent.command_line, process.executable.name, process.command_line, process.pid

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Indikatoren

Datei-Hashes (13)

  • 3ac2c91245e980c4fd0991e5c1971439e234c0713e994d1dae532c70b7528587
  • 9753e2eba8f0ff056d60c52a917f7760ea81227e41b1786260e1ac76db398434
  • 7b2a949bf460fb37a3888c9048698f43222a185a48323023df1c51e78a3ca1c2
  • c29cbe1a9aaef322cc3f316ceeabe8a8071b18441a5e3c3ec348069739e59e80
  • 4c54090b8906508fe404e65e9209949f2edb2788a35830cc59b9464ef92522f7
  • 48f1e1fd1b241df4a37487ef67b3e59210bd03c74d6bcdb4ef9561111de023d2
  • 06b047b6c07ee32f2b685af42a7312c62e7f6eeda747e6102cb48936fd91c4ee
  • 6bc4af5512488476af2497c81adda24a4a034ca65ef21e4b7644581bd48f272d
  • 677fc978772df2a4d771582f5eb6933f0d4bb6bb94b09d3f504341c5b9d08c61
  • 624579cee4d9082f5f3945ceb2474ab5aeb222c2003b503b3df8f1dde60e4def
  • b13d98c81253fc6c05563f82af651b8a18fd47d9f4430f325dc2c2a576b7ddc2
  • b269383239464a945d17cfabfccf53935b83d80d907922310fdfd50d80274c66
  • 880c5c5323305154aaed3fa5238d6186cda3bcfa3a82645243c1e7999e35602a

Übernommen wurden nur Indikatoren, die wörtlich in einer Hersteller- oder Research-Quelle standen.

Referenzen