Notepad++ CVE-2026-85995

Exploitation requires (1) the attacker to already be able to replace or plant the updater-related file (GUP.exe) in Notepad++'s install location - i.e., local write access to that path, which in a default Program Files install typically demands elevated/admin rights, or a user-writable install directory; (2) the victim to actively trigger the updater path (UI:R) so the tampered binary is verified and launched; and (3) an affected version in the range 8.9.7 up to (not including) 8.9.8 on Windows. The core defect is that the signature-verification path accepts a modified GUP.exe whose Authenticode digest is invalid because chain-of-trust checking was disabled (_doCheckChainOfTrust=false). Limiting factors: it is NOT remotely exploitable on its own (the vendor explicitly states no RCE by itself), it needs local file-tampering access plus user interaction, and it is fixed in 8.9.8.

This is a code-signing verification flaw (CWE-347) whose real-world risk is moderate and gated by a significant precondition: the attacker must already be able to replace or plant the updater file (GUP.exe) on the victim's machine. The vendor CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H (7.3) is internally consistent with the description - local attack vector, some prior foothold/privileges, and required user interaction (the user must trigger the updater path). SSVC reinforces a lower operational priority: Exploitation=none (no observed exploitation), Automatable=no (requires local file placement plus user-initiated update, not scriptable at scale), while Technical Impact=total reflects that success yields attacker code execution in the user's context. There is no KEV listing and no POC in the input, so exploitation status is 'no public exploit identified at time of analysis.' The high C:H/I:H/A:H impact scoring inflates the headline number relative to the practical difficulty: because an attacker who can already write GUP.exe into the Notepad++ install path often already has meaningful access, the signature bypass is best understood as a defense-in-depth failure / integrity-control bypass rather than an initial-access RCE. The 'RCE' tag overstates severity - the description explicitly says the issue 'does not provide remote code execution by itself.' Net: a legitimate integrity bug worth patching, but not a drop-everything remotely-exploitable priority.

An attacker with the ability to write to the Notepad++ program directory (e.g., a prior local foothold or a user-writable install location) replaces GUP.exe with a malicious binary that retains embedded certificate metadata but has an invalid Authenticode digest. Because the verification path (with chain-of-trust checking disabled) accepts the file despite the broken signature, the attacker's code executes in the user's context the next time the victim triggers the update flow. No public POC is identified in the provided data.