Notepad++ EUVD-2026-60375

Exploitation requires three concurrent conditions: (1) the target must be running Notepad++ prior to version 8.9.7 on Windows; (2) the user must actively trigger or accept a WinGup update - the CVSS UI:R metric confirms this user interaction is mandatory and the attack cannot proceed silently without it; and (3) the attacker must control or intercept the update delivery channel to substitute a malicious ZIP for a legitimate update package (e.g., via MitM, compromised update CDN, or DNS spoofing). Exploitation is further bounded by the need for the Notepad++ process to have write access to the plugin directory - standard user-level installations will have this, but hardened environments with read-only plugin directories will block the DLL overwrite. Code execution does not occur at extraction time; a second trigger (Notepad++ restart and plugin load) is required. There is no configuration toggle or feature flag that enables or disables vulnerability exposure - all installations using WinGup prior to 8.9.7 are affected.

The CVSS 8.1 score (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) reflects low-complexity, unauthenticated network delivery requiring only a single user interaction - a realistic threshold given that triggering an update is a routine user action. The C:N metric in the NVD vector is arguably underrated: while the direct vulnerability is DLL overwriting (I:H), successful exploitation culminates in arbitrary code execution, which yields confidentiality impact in practice. Real-world risk is meaningfully elevated by Notepad++'s broad install base and the fact that the attack vector is the update mechanism itself, a trusted workflow. No EPSS score was provided in the input data and no CISA KEV listing exists, suggesting no confirmed widespread exploitation. The absence of POC code reduces near-term opportunistic risk, but the GitHub advisory and commit diff publish a clear roadmap for exploit development. The update-delivery attack angle (MitM or compromised update server) does add a prerequisite that limits casual exploitation compared to a direct remotely exploitable service.

An attacker who can intercept or substitute Notepad++'s update package - via network MitM, DNS hijacking targeting the update server, or compromise of the update distribution infrastructure - delivers a crafted ZIP containing an entry named '../mimeTools/mimeTools.dll'. When a user running Notepad++ prior to 8.9.7 triggers an update check and accepts the download, WinGup extracts the archive and writes the attacker's DLL into the mimeTools plugin directory. The next time Notepad++ starts and loads the mimeTools plugin, the attacker's code executes in the user's security context with no further interaction.