Notepad++ Vulnerability CVE-2026-3008 Issued, Update Now
Summary
CSA has issued CVE-2026-3008 to a string injection vulnerability in Notepad++, an open-source text editor. The vulnerability affects Notepad++ version 8.9.3, and successful exploitation could allow an attacker to obtain memory address information or crash the application. Users and administrators of the affected product version are advised to update to the latest version 8.9.4 immediately.
“Successful exploitation of the string injection vulnerability could allow an attacker to obtain memory address information or crash the application.”
Organizations should treat this as a priority patch cycle: inventory Notepad++ installations across endpoints, server environments, and development tooling, then deploy version 8.9.4. While the stated impact is limited to memory disclosure and denial-of-service, string injection flaws can occasionally chain with other vulnerabilities for more severe outcomes.
About this source
The Cyber Security Agency of Singapore is the country's lead cybersecurity authority. Their alerts and advisories page publishes vulnerability notifications, active exploitation warnings, and remediation guidance with a focus on software widely used across ASEAN enterprise: financial services, telecoms, healthcare, government. Around 30 advisories a month, each with CVE references, severity, and patching steps. CSA tends to publish faster than CISA on vulnerabilities affecting Asian-headquartered vendors and is the authoritative voice for Singapore-licensed financial institutions under the MAS Technology Risk Management framework. Watch this if you run security in Asia-Pacific, advise MAS-regulated firms, or track regional CVE coverage. GovPing publishes each advisory with affected vendor, CVE, and original CSA link.
What changed
CSA has issued a CVE ID (CVE-2026-3008) for a string injection vulnerability in Notepad++ version 8.9.3. Successful exploitation could allow an attacker to obtain memory address information or crash the application. The Product Owner of Notepad++ has released security update version 8.9.4 to address the vulnerability.
Organizations and individual users running Notepad++ version 8.9.3 should update to version 8.9.4 immediately to mitigate the risk of memory address disclosure or application crashes. Security teams should inventory their software deployments to identify affected installations and prioritize patching.
What to do next
- Update to the latest version 8.9.4 immediately
Archived snapshot
Apr 27, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
Alerts
Vulnerability in Notepad++
27 April 2026
CSA has issued a CVE ID to a vulnerability reported in Notepad++ as part of CSA's Responsibility Vulnerability Disclosure Policy. Users and administrators of the affected product version are advised to update to the latest version 8.9.4 immediately.
Background
CSA has issued a CVE ID (CVE-2026-3008) to a vulnerability reported in Notepad++, an open-source text editor. The Product Owner of Notepad++ has released a security update to address the vulnerability.
Impact
Successful exploitation of the string injection vulnerability could allow an attacker to obtain memory address information or crash the application.
Affected Products
The vulnerability affects Notepad++ version 8.9.3.
Mitigation
Users and administrators of the affected product version are advised to update to the latest version 8.9.4 immediately.
Special Thanks to:
• Informer: Mr Hazley Samsudin
• Product Owner: Notepad++
References
https://community.notepad-plus-plus.org/topic/27500/notepad-v8-9-4-release-candidate
https://github.com/llgsjsm/cve-2026-3008
https://llgsjsm.github.io/cve-2026-3008/
https://github.com/notepad-plus-plus/notepad-plus-plus/issues/17960
Related changes
Get daily alerts for CSA Alerts & Advisories (Singapore)
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
Source
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from CSA.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when CSA Alerts & Advisories (Singapore) publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.