CVE-2026-3008

Vulnerability in Notepad++

State: Published
Severity: 6.6 Medium
Published: Apr 27, 2026
Updated: Apr 27, 2026
Reserved: Feb 23, 2026

Description

Successful exploitation of the string injection vulnerability could allow an attacker to obtain memory address information or crash the application.

Scores

CVSS	Score	Vector	Source
3.1	6.6 Medium	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H	CSA

Weaknesses

CWE-134 Use of Externally-Controlled Format String

Affected Products

Product	Versions
Notepad++Notepad++	8.9.3Affected

References

https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-044/
https://community.notepad-plus-plus.org/topic/27500/notepad-v8-9-4-release-candidate
https://github.com/llgsjsm/cve-2026-3008
https://llgsjsm.github.io/cve-2026-3008/
https://github.com/notepad-plus-plus/notepad-plus-plus/issues/17960

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.