Notepad++ 8.8.9 closes a vulnerability and includes other fixes.

An important update is available for Notepad++. Version 8.8.9 patches a vulnerability that could allow the updater to be redirected to a malicious server. This update closes the vulnerability, but investigations are still ongoing.

Some security researchers recently discovered cases where Notepad++ update traffic was being hijacked. In these incidents, the WinGUp updater was sometimes redirected to malicious servers, causing it to download harmful files instead of the real update.

Their investigation revealed a weakness in how the updater checks whether a downloaded update is genuine and safe. If an attacker can intercept the connection between the updater and the official Notepad++ update servers, they could exploit this weakness to trick the updater into downloading and running a malicious file.

To fix this issue and address the concerns raised by the researchers, this Notepad++ release includes a new security improvement that strengthens the update verification process. The investigation is still underway to understand exactly how the traffic was hijacked.

Release Notes for Notepad++ 8.8.9

• Security vulnerability fixed: Certificate and signature verification of the downloaded update installer. (Implementation of Notepad++ commit, WinGUp commit)

• Fixed: Loading corrupted files on Windows with a full UTF-8 code page.

• Fixed: Crash when hashing SHA-256 for large files.

• Bug fix: "Select and Find Next" command no longer works.

• MSI improvement: Added NOUPDATER option and suppressed REBOOT.

• Perl function list causes Notepad++ to freeze when switching tabs.

• The context menu is truncated when localization changes are made.

• Added ability to update users' "langs.xml" and "stylers.xml" files from XML model files.

• Added function to sort lines in a document by length.

• And other fixes.

Find the complete release notes here.