Which versions of Notepad++ are affected by CVE-2026-46710?

Notepad++ versions 8.9.4-8.9.5 contain a Windows installer vulnerability enabling unprivileged attackers to escalate to administrator privileges.. A patch is available.

How to fix or mitigate CVE-2026-46710?

24 hours: Scan infrastructure to identify all systems running Notepad++ 8.9.4-8.9.5; document affected systems and restrict installation permissions where possible. 7 days: Deploy Notepad++ version 8.9.6 or later to all affected systems using patch management. 30 days: Verify patch deployment completion; monitor system logs for signs of exploitation attempts during the vulnerable period.

Notepad++ CVE-2026-46710

Q: What is the CVSS score of CVE-2026-46710?

CVE-2026-46710 has a CVSS 4.0 base score of 7.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-39905 HIGH

Untrusted Search Path (CWE-426)

2026-06-26 GitHub_M

Privilege Escalation Notepad Plus Plus

7.5

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.0 HIGH

Local-only binary planting (AV:L); multiple preconditions and a privileged user must select the attacker dir, so AC:H and UI:R; attacker needs no prior privileges (PR:N); code runs as installer with full C/I/A.

3.1 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 26, 2026 - 22:02 EUVD

Source Code Evidence Fetched

Jun 26, 2026 - 21:24 vuln.today

Analysis Generated

Jun 26, 2026 - 21:24 vuln.today

DescriptionCVE.org

Notepad++ is a free and open-source source code editor. From 8.9.4 until 8.9.6, Notepad++ contains a local privilege escalation vulnerability in the installer. During installation, the installer invokes powershell.exe without using an absolute path after setting the working directory to the installation contextMenu directory. If an attacker can pre-place a malicious powershell.exe in a user-writable custom installation directory, and a privileged user later runs the installer and selects that directory, the attacker-controlled executable is launched with the elevated privileges of the installer. This vulnerability is fixed in 8.9.6.

AnalysisAI

Local privilege escalation in the Notepad++ Windows installer (versions 8.9.4 through 8.9.5) lets an unprivileged local attacker gain the elevated privileges of the installer by planting a malicious powershell.exe. Because the installer calls powershell.exe by name (not absolute path) after setting the working directory to the installation contextMenu folder, a privileged user who installs into an attacker-writable custom directory triggers execution of the attacker's binary. No public exploit has been identified at time of analysis; the issue is fixed in 8.9.6 and corresponds to CWE-426 (Untrusted Search Path).

Technical ContextAI

The root cause is CWE-426 (Untrusted Search Path / insecure binary resolution) in the NSIS-based installer script (PowerEditor/installer/nppSetup.nsi). To register the Windows 11 modern right-click context menu, the installer ran 'powershell -Command "Add-AppxPackage ..."' invoking powershell.exe by bare name. On Windows, command resolution searches the current working directory and PATH; since the installer first set its working directory to $INSTDIR\contextMenu, a powershell.exe placed alongside the MSIX in that directory is resolved and executed before the legitimate System32 copy. The affected product per CPE is cpe:2.3:a:notepad-plus-plus:notepad-plus-plus, the widely used open-source Windows source-code editor. The fix reads the trusted PowerShell path from HKLM\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell and invokes that absolute path instead.

RemediationAI

Vendor-released patch: upgrade to Notepad++ 8.9.6, which resolves the PowerShell path from the HKLM registry (SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell) and invokes that absolute path instead of the bare 'powershell' name; obtain it via the official release and review the advisory at https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-6f8f-vmfc-r8c5. If you cannot immediately patch, run the installer only from trusted, non-writable locations and install Notepad++ into a default protected path such as %ProgramFiles% (which standard users cannot write to), avoiding custom user-writable installation directories where a malicious powershell.exe could be pre-placed - the trade-off is loss of flexible install-location choice. Additionally, audit candidate install directories for a stray powershell.exe before running the elevated installer, and restrict who can drop files into shared install staging folders; these controls reduce the planting opportunity but do not substitute for upgrading.