Notepad
CVE-2026-25926
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessPlace malicious explorer.exe in attacker-controlled directory
-
ExploitUser launches Windows Explorer from Notepad++
-
ExecutionSystem searches current working directory first
-
ImpactExecute malicious explorer.exe with Notepad++ privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V13 - Configuration Search path verification
|
| Exploitation Conditions | Notepad++ versions prior to 8.9.2 with Windows Explorer launch feature; attacker must control process working directory (e.g., shared folder, user-writable location); user interaction required to trigger Explorer launch via UI. |
| Impact | CVSS 7.3 (HIGH). Attack vector: Local. Complexity: Low. Privileges required: Low. User interaction: Required. Public exploit/POC available. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability to execution of a malicious explorer. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Notepad++ versions before 8.9.2 allow local code execution through an unsafe search path vulnerability that permits attackers to hijack the Windows Explorer executable if they control the process working directory. A user with local access running the affected application could be tricked into executing a malicious explorer.exe, leading to arbitrary code execution with application privileges. Public exploit code exists for this vulnerability and no patch is currently available.
Earlier versions of this analysis (1)
Notepad++ is a free and open-source source code editor. An Unsafe Search Path vulnerability (CWE-426) exists in versions prior to 8.9.2 when launching Windows Explorer without an absolute executable path. [CVSS 7.3 HIGH]
RemediationAI
Monitor vendor advisories for a patch.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-426 (Untrusted Search Path). Affects Notepad\+\+. Notepad++ is a free and open-source source code editor. An Unsafe Search Path vulnerability (CWE-426) exists in versions prior to 8.9.2 when launching Windows Explorer without an absolute executable path. This may allow execution of a malicious explorer.exe if an attacker can control the process working directory. Under certain conditions, this could lead to arbitrary code execution in the context of the running application. Version 8.9.2 patches the issue.
Know when Notepad gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Notepad++ is a free and open-source source code editor. An Unsafe Search Path vulnerability (CWE-426) exists in versions prior to 8.9.2 when launching Windows Explorer without an absolute executable path. This may allow execution of a malicious explorer.exe if an attacker can control the process working directory. Under certain conditions, this could lead to arbitrary code execution in the context of the running application. Version 8.9.2 patches the issue.
Executive ViewAI
Notepad++ versions before 8.9.2 contain a privilege escalation vulnerability that allows attackers to execute arbitrary code by exploiting unsafe file search paths during Windows Explorer operations. This poses a risk to any organization using affected Notepad++ installations, particularly those where users have administrative access or work with untrusted files.
Since no patch is currently available: (1) Disable or restrict the Windows Explorer integration feature in Notepad++ through group policy or application configuration; (2) Apply application whitelisting/blacklisting policies to limit Notepad++ execution to trusted administrative users only; (3) Implement endpoint detection and response (EDR) monitoring to flag suspicious child process execution from Notepad++; (4) Restrict write permissions in system directories and Program Files to prevent DLL search path exploitation; (5) Advise users to avoid launching Notepad++ from untrusted locations or with untrusted files; (6) Monitor CVE-2026-25926 for patch availability and prioritize deployment immediately upon release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)GitHub Advisory
Buffer overflow in NotePad++ 6.6.9 allows remote attackers to have unspecified impact via a long Time attribute in an Ev
Notepad++ versions prior to 8.8.9 contain an update integrity verification vulnerability (CVE-2025-15556) when using the
memono Notepad 4.2 contains a denial of service vulnerability that allows attackers to crash the application by pasting
An Untrusted search path vulnerability in notepad++ 6.5 allows local users to gain escalated privileges through the msim
Notepad++ is a free and open-source source code editor. Rated high severity (CVSS 7.8), this vulnerability is no authent
Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerable dll (Ux
SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode ch
String injection in Notepad++ 8.9.3 leads to memory address disclosure or application crash when processing maliciously
Notepad++ v8.4.1 was discovered to contain a stack overflow via the component Finder::add(). Rated medium severity (CVSS
Notepad++ is a free and open-source source code editor. Rated medium severity (CVSS 5.5), this vulnerability is no authe
Notepad++ is a free and open-source source code editor. Rated medium severity (CVSS 5.5), this vulnerability is no authe
Notepad++ is a free and open-source source code editor. Rated medium severity (CVSS 5.5), this vulnerability is no authe
Exploit-DB