Notepad++ EUVD-2026-39905

Requires all of: (1) the attacker can pre-place a malicious powershell.exe in a user-writable custom installation directory; (2) a privileged user subsequently runs the affected Notepad++ installer (8.9.4-8.9.5); and (3) that privileged user explicitly selects the attacker-controlled directory as the install target, triggering the context-menu / Add-AppxPackage registration step. Limiting factors: exploitation is local only (AV:L), depends on a non-default install path (installing into the default %ProgramFiles% - not user-writable - prevents it), and hinges on a privileged user's action and directory choice, which is why real-world attack complexity is high despite the High CVSS score.

Signals are mixed and point to a real-but-conditional risk rather than a mass-exploitation emergency. The CVSS 4.0 vector (AV:L/AC:H/AT:N/PR:N/UI:N) yields 7.5 (High): local attack vector, high attack complexity, and full confidentiality/integrity/availability impact (VC:H/VI:H/VA:H) with no scope change. Notably the vector lists UI:N, which conflicts with the description - exploitation clearly requires a privileged user to run the installer and select the attacker-writable directory, i.e. victim interaction; treat the published UI:N as likely understated and AC:H as the more honest reflection of the multiple preconditions. There is no CISA KEV listing and no EPSS score in the provided data, and no public exploit identified - consistent with a niche, socially-gated local EoP that is unattractive for automated mass exploitation. SSVC framing: exploitation = none observed, automatable = no (requires a privileged human action and a non-default install path), technical impact = total. Net: a legitimate hardening priority for environments where users install software into custom/shared directories, but not an internet-facing emergency.

An attacker who can write to a shared or user-controlled directory (e.g., a common downloads or staging folder) drops a malicious powershell.exe there. An administrator later runs the Notepad++ installer and selects that directory as the install target; during context-menu registration the installer launches the planted powershell.exe with elevated privileges, executing the attacker's code as the installing (privileged) user. No public POC is currently identified, and the high attack complexity reflects the need to win this timing/path race.