Notepad++ v8.9.8 vulnerability fixes, bug-fixes & new enhancements:

1. Vulnerabilty: Fix an eventual crash while loading UDL. CVE ID not assigned yet
2. Vulnerabilty: Fix an eventual crash when loading a UTF-16 file. CVE ID not assigned yet
3. Vulnerabilty: Fix out-of-bounds array write. CVE ID not assigned yet
4. Vulnerabilty: Fix authenticode verification bypass. CVE ID not assigned yet
5. Vulnerabilty: Fix a TOCTOU issue in the Notepad++ Updater (WinGUp). CVE ID not assigned yet
6. Vulnerabilty: Fix session backup path-traversal allowing deletiion outside backup directory. CVE ID not assigned yet
7. Vulnerabilty: Fix potential exposure of Windows login info (SMB/NTLM) via UNC path. CVE ID not assigned yet 1, CVE ID not assigned yet 2, CVE ID not assigned yet 3, CVE ID not assigned yet 4
8. Vulnerabilty: Fix shortcuts.xml HMAC bypass via the “Run a Macro Multiple Times”. CVE ID not assigned yet
9. Vulnerabilty: Fix Null pointer in NPPM_SAVESESSION handler causing crash. CVE ID not assigned yet
10. Vulnerabilty: Fix stack buffer overflow caused by overlong session paths. CVE ID not assigned yet
11. Vulnerabilty: Fix Folder as Workspace “Run by system” target hijacking issue. CVE ID not assigned yet
12. Fix crash in WM_COPYDATA COPYDATA_PARAMS for invalid payload. (Fix #18207)
13. Fix crash in API NPPM_ALLOCATE* calls. (Fix #18222)
14. Fix CJK IME issues in Save As dialog. (Fix #11582, #15431, #16772, #12225, #12366)
15. Update to Scintilla 5.6.6 & Lexilla 5.5.3. (Implement #18290)
16. Add plugin deactivation capability. (Fix #18206)
17. Add “-monitoringMode” command line argument to open files with monitoring enabled. (Fix #18188)
18. Fix Proxy Settings issue in portable mode. (Fix #13382)
19. Fix langs.xml model update not not applying file extension fields. (Fix #18220)
20. Fix luminosity slider in ChooseColor not visible in dark mode. (Fix #12451)
21. Fix empty sub-menus in compact language menu. (Fix #18202)
22. Fix Search Results vertical scrolling not matching with OS mouse settings. (Implement #18194)
23. Use modern question mark icon in dark message box. (Fix Repported in comment)
24. Format count numbers using current locale separators when needed. (Fix #18190)

Please note that all the vulnerability links might not be accessible for the moment. They will be published once the release is available.