Notepad++ release 8.9.8.1

donho

Notepad++ release 8.9.8.1 is available:

https://notepad-plus-plus.org/news/v8981-released/

Notepad++ v8.9.8.1 vulnerability fixes, regression fix & bug-fixes:

Vulnerability: Fix crash caused by “Open file” & “Search on Internet” commands. CVE ID not assigned yet
Vulnerability: Fix Function List array out-of-bounds risks when parsing functions. CVE ID not assigned yet
Vulnerability: Fix UAC operations performed without verifying the caller. CVE ID not assigned yet
Vulnerability: Fix incomplete UNC detection allowing NTLM leak bypass. CVE ID not assigned yet
Vulnerability: Fix crash of NPPM API when invalid value passed as argument. CVE ID not assigned yet
Regression: Fix failure to open files via Notepad++ symlink paths. (Fix #18314)
Fix a crash after canceling UAC saving operation. (Fix commit)
Fix Network Path Warning dialog usability problem. (Fix #18319 (comment))
Fix symlinks setting for Folder as Workspace not remembered across sessions. (Fix #18367)
Fix continous validation of the same server when loading network path files. (Fix #18319)
Fix UDL line comments not being correctely detected. (Fix #9193, #18141)
Fix Unicode text alternation in clipboard by Notepad++ encoding conversion. (Fix #18356)
Fix incorrect paste behaviour in column mode. (Fix #18355)
Fix visual glitch in the UDL dialog when main window uses vertical tabs. (Fix #18335)
Fix GDI leaks of tab context menu. (Fix #18297)
Fix inaccurate display information in PluginAdmin “Updates” tab. (Fix #18312)

Notepad++ v8.9.8 vulnerability fixes, bug-fixes & new features:

Vulnerabilty: Fix an eventual crash while loading UDL. CVE ID not assigned yet
Vulnerabilty: Fix an eventual crash when loading a UTF-16 file. CVE ID not assigned yet
Vulnerabilty: Fix out-of-bounds array write. CVE-2026-85279
Vulnerabilty: Fix authenticode verification bypass. CVE-2026-85995
Vulnerabilty: Fix a TOCTOU issue in the Notepad++ Updater (WinGUp). CVE ID not assigned yet
Vulnerabilty: Fix session backup path-traversal allowing deletiion outside backup directory. CVE ID not assigned yet
Vulnerabilty: Fix potential exposure of Windows login info (SMB/NTLM) via UNC path. CVE ID not assigned yet 1, CVE ID not assigned yet 2, CVE ID not assigned yet 3, CVE ID not assigned yet 4
Vulnerabilty: Fix shortcuts.xml HMAC bypass via the “Run a Macro Multiple Times”. CVE-2026-85288
Vulnerabilty: Fix Null pointer in NPPM_SAVESESSION handler causing crash. CVE-2026-86056
Vulnerabilty: Fix stack buffer overflow caused by overlong session paths. CVE-2026-86054
Vulnerabilty: Fix Folder as Workspace “Run by system” target hijacking issue. CVE-2026-77605
Vulnerabilty: Fix install-path injection possibility with PowerShell. CVE ID not assigned yet
Vulnerabilty: Fix lower IL (Integrity Level) process sends WM_COMMAND to higher IL Notepad++. CVE ID not assigned yet
Vulnerabilty: Fix Notepad++ UIPI Bypass via WM_COPYDATA. CVE ID not assigned yet
Fix crash in WM_COPYDATA COPYDATA_PARAMS for invalid payload. (Fix #18207)
Fix crash in API NPPM_ALLOCATE* calls. (Fix #18222)
Add an option to allow loading symlinks in Folder as Workspace. (Fix #18226)
Regression: Fix loading session for alone subview and doc/tab with untitle name. (Fix #18294)
Fix CJK IME issues in Save As dialog. (Fix #11582, #15431, #16772, #12225, #12366)
Update to Scintilla 5.6.6 & Lexilla 5.5.3. (Implement #18290)
Add plugin deactivation capability. (Fix #18206)
Add “-monitoringMode” command line argument to open files with monitoring enabled. (Fix #18188)
Fix Proxy Settings issue in portable mode. (Fix #13382)
Fix langs.xml model update not applying file extension fields. (Fix #18220)
Fix luminosity slider in ChooseColor not visible in dark mode. (Fix #12451)
Fix empty sub-menus in compact language menu. (Fix #18202)
Fix Search Results vertical scrolling not matching with OS mouse settings. (Implement #18194)
Use modern question mark icon in dark message box. (Fix Repported in comment)
Format count numbers using current locale separators when needed. (Fix #18190)

Auto-updater will be triggered in about 1 week, if no critical issue found in this release.

schnurlos

Typo at 24 “not not”

Artur Harison

@donho
Strange behavior with Cyrillic.
Reload from disk, or update after modification. File encoding resets to ANSI.
Image

Add
Autodetect encode off
I suspect problem lies in second line.
But how text can affect on encode.

andrecool-68

In Windows 7, there is no confirmation dialog for the “Move file to Recycle Bin” action.
In Windows 10, the confirmation dialog for “Move file to Recycle Bin” is present.

Is this by design, or is it a bug?

Снимок.PNG

donho

@Artur-Harison

I cannot reproduce your issue. Reload the file after some changes in text, it’s still working for me:

Artur Harison

@donho
I uplad file.
I cannot isolate the regression conditions.
But you can repeat his with his file.
Text file for teproduction
Video…

donho

@andrecool-68 said:

In Windows 7, there is no confirmation dialog for the “Move file to Recycle Bin” action.
In Windows 10, the confirmation dialog for “Move file to Recycle Bin” is present.

It’s due to:
https://github.com/notepad-plus-plus/notepad-plus-plus/blob/master/PowerEditor/src/NppIO.cpp#L2357

	winVer winVersion = (NppParameters::getInstance()).getWinVersion();
	bool goAhead = true;
	if (winVersion >= WV_WIN8 || winVersion == WV_UNKNOWN)
	{
		// Windows 8 (and version after?) has no system alert, so we ask user's confirmation
		goAhead = (doDeleteOrNot(fileNamePath) == IDOK);
	}

	if (goAhead)
	{
		...
		if (!MainFileManager.deleteFile(bufferID))
		{
			...

Is this by design, or is it a bug?

So it was by design. However, a modification was added in deleteFile about one year ago, by @xomx :

fileOpStruct.fFlags = FOF_ALLOWUNDO | FOF_NOCONFIRMATION; // FOF_NOCONFIRMATION - prevent possible redundant shell-dlg (Notepad++ uses its own delete-confirmation dlg)

(ref: https://github.com/notepad-plus-plus/notepad-plus-plus/commit/de7aa5ae7afb23a900f243120fefeb7a8a3d6ef2)

That disables the OS popup while calling SHFileOperation.

As a result, I think it’s safe to remove OS detection and display Notepad++ build-in warning dialog unconditionally.

I’ll do a commit to fix it.

donho

donho said:

As a result, I think it’s safe to remove OS detection and display Notepad++ build-in warning dialog unconditionally.

I’ll do a commit to fix it.

The issue is fixed in the master. The fix will be in the next release:
https://github.com/notepad-plus-plus/notepad-plus-plus/commit/ee0106b823575715842e4b45939ee355b8610ecf

donho

@Artur-Harison
Still cannot reproduce your issue with the file you provided.

Before

After

Is it rather a plugin issue?

Coises

@donho said:

Still cannot reproduce your issue with the file you provided.

@Artur-Harison said:
Autodetect encode off

With Audodetect character encoding not checked, Notepad++ sees the file as ANSI.

I think Artur’s complaint is that, after selecting Encoding | UTF-8 and then reloading the file, the explicitly set encoding does not stick; Notepad++ reverts to the encoding it “thinks” the file should be (ANSI).

I don’t know if that counts as a bug or as expected behavior.

Artur Harison

@Coises
1 file in utf-8
2 file opened in utf-8
3 after refresh, file toggled in ANSI
————-
@donho
You don’t need to change the file.
Need just open it and reload from disc.

Strange behavior. If you add spacebar anywere
Problem is gone. If again delete space, problem back. O_o
But it’s work a long 1401 line.
If edit after, problem remain.

All plugs off.
X64
Win10
Auto encode off.

Coises

@Artur-Harison said:

@Coises
1 file in utf-8
2 file opened in utf-8
3 after refresh, file toggled in ANSI

I don’t get quite the same result. If I open your test file, Notepad++ thinks it is “ANSI.” I have to change it to UTF-8 using the Encoding menu.

Strange behavior. If you add spacebar anywere
Problem is gone.

That is almost certainly this bug.

Edit to add:

If I rename your file to new_1_test.xml I get exactly the behavior you describe: it opens as UTF-8 but reloads as ANSI. That is surely a bug.

Artur Harison

@Coises
I think you’re right.
If you are encode utf 8 and safe. And reload. Against it’s be Ansi. But if add one spacebar. Problem is gone, but if again delete spacebar. Problem is back.
XML lang detector problem! ?
—-
File was edited in utf 8 format.
Encoding obey XML in first line of document.
But after reload, bufer reads as ANSI, and ignored specification encoding.