Notepad++ release 8.9.8.1 is available:
https://notepad-plus-plus.org/news/v8981-released/
Notepad++ v8.9.8.1 vulnerability fixes, regression fix & bug-fixes:
Vulnerability: Fix crash caused by “Open file” & “Search on Internet” commands. CVE ID not assigned yet
Vulnerability: Fix Function List array out-of-bounds risks when parsing functions. CVE ID not assigned yet
Vulnerability: Fix UAC operations performed without verifying the caller. CVE ID not assigned yet
Vulnerability: Fix incomplete UNC detection allowing NTLM leak bypass. CVE ID not assigned yet
Vulnerability: Fix crash of NPPM API when invalid value passed as argument. CVE ID not assigned yet
Regression: Fix failure to open files via Notepad++ symlink paths. (Fix #18314)
Fix a crash after canceling UAC saving operation. (Fix commit)
Fix Network Path Warning dialog usability problem. (Fix #18319 (comment))
Fix symlinks setting for Folder as Workspace not remembered across sessions. (Fix #18367)
Fix continous validation of the same server when loading network path files. (Fix #18319)
Fix UDL line comments not being correctely detected. (Fix #9193, #18141)
Fix Unicode text alternation in clipboard by Notepad++ encoding conversion. (Fix #18356)
Fix incorrect paste behaviour in column mode. (Fix #18355)
Fix visual glitch in the UDL dialog when main window uses vertical tabs. (Fix #18335)
Fix GDI leaks of tab context menu. (Fix #18297)
Fix inaccurate display information in PluginAdmin “Updates” tab. (Fix #18312)
Notepad++ v8.9.8 vulnerability fixes, bug-fixes & new features:
Vulnerabilty: Fix an eventual crash while loading UDL. CVE ID not assigned yet
Vulnerabilty: Fix an eventual crash when loading a UTF-16 file. CVE ID not assigned yet
Vulnerabilty: Fix out-of-bounds array write. CVE-2026-85279
Vulnerabilty: Fix authenticode verification bypass. CVE-2026-85995
Vulnerabilty: Fix a TOCTOU issue in the Notepad++ Updater (WinGUp). CVE ID not assigned yet
Vulnerabilty: Fix session backup path-traversal allowing deletiion outside backup directory. CVE ID not assigned yet
Vulnerabilty: Fix potential exposure of Windows login info (SMB/NTLM) via UNC path. CVE ID not assigned yet 1, CVE ID not assigned yet 2, CVE ID not assigned yet 3, CVE ID not assigned yet 4
Vulnerabilty: Fix shortcuts.xml HMAC bypass via the “Run a Macro Multiple Times”. CVE-2026-85288
Vulnerabilty: Fix Null pointer in NPPM_SAVESESSION handler causing crash. CVE-2026-86056
Vulnerabilty: Fix stack buffer overflow caused by overlong session paths. CVE-2026-86054
Vulnerabilty: Fix Folder as Workspace “Run by system” target hijacking issue. CVE-2026-77605
Vulnerabilty: Fix install-path injection possibility with PowerShell. CVE ID not assigned yet
Vulnerabilty: Fix lower IL (Integrity Level) process sends WM_COMMAND to higher IL Notepad++. CVE ID not assigned yet
Vulnerabilty: Fix Notepad++ UIPI Bypass via WM_COPYDATA. CVE ID not assigned yet
Fix crash in WM_COPYDATA COPYDATA_PARAMS for invalid payload. (Fix #18207)
Fix crash in API NPPM_ALLOCATE* calls. (Fix #18222)
Add an option to allow loading symlinks in Folder as Workspace. (Fix #18226)
Regression: Fix loading session for alone subview and doc/tab with untitle name. (Fix #18294)
Fix CJK IME issues in Save As dialog. (Fix #11582, #15431, #16772, #12225, #12366)
Update to Scintilla 5.6.6 & Lexilla 5.5.3. (Implement #18290)
Add plugin deactivation capability. (Fix #18206)
Add “-monitoringMode” command line argument to open files with monitoring enabled. (Fix #18188)
Fix Proxy Settings issue in portable mode. (Fix #13382)
Fix langs.xml model update not not applying file extension fields. (Fix #18220)
Fix luminosity slider in ChooseColor not visible in dark mode. (Fix #12451)
Fix empty sub-menus in compact language menu. (Fix #18202)
Fix Search Results vertical scrolling not matching with OS mouse settings. (Implement #18194)
Use modern question mark icon in dark message box. (Fix Repported in comment)
Format count numbers using current locale separators when needed. (Fix #18190)
Auto-updater will be triggered in about 1 week, if no critical issue found in this release.