CVE-2026-3008 PUBLISHED

Successful exploitation of the string injection vulnerability could allow an attacker to obtain memory address information or crash the application.

Users and administrators of the affected product version are advised to update to the latest version 8.9.4 immediately.

• https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-044/
• https://community.notepad-plus-plus.org/topic/27500/notepad-v8-9-4-release-candidate
• https://github.com/llgsjsm/cve-2026-3008
• https://llgsjsm.github.io/cve-2026-3008/
• https://github.com/notepad-plus-plus/notepad-plus-plus/issues/17960