Back Gbhackers

Notepad++ Vulnerability Lets Attackers Crash App and Expose Memory Data

Gbhackers •Divya • April 28, 2026

A new string injection vulnerability, tracked as CVE-2026-3008, has been discovered in Notepad++ version 8.9.3. This critical flaw allows attackers to crash the application or to instantly and secretly extract sensitive memory information. The Cybersecurity Agency of Singapore (CSA) has issued an urgent advisory urging all users to immediately upgrade to version 8.9.4 to secure […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerability in Notepad++ Allows DoS and Memory Disclosure A format string injection vulnerability, tracked as CVE-2026-3008, has been identified in Notepad++ version 8.9.3. This flaw enables attackers to crash the application or leak sensitive memory information through a malicious language pack. The vulnerability affects users of Notepad++ who load the compromised nativeLang.xml file, leading to a denial of service (DoS) and potential information disclosure. The Cybersecurity Agency of Singapore (CSA) has issued an urgent advisory for users to upgrade to version 8.9.4 to mitigate the risk. The vulnerability was publicly disclosed on April 27, 2026, with a proof of concept available since April 20, 2026. Users are strongly advised to update their software immediately to avoid exploitation. The attack vector relies on the improper handling of format strings in the application, which can lead to crashes and memory leaks. 6 sources 75

Extracted Entities

CVEs (1)

CVE-2026-3008

CWE Weaknesses (1)

CWE-94 - Code Injection