Notepad Plus Plus
Monthly
Improper signature verification in the Notepad++ updater path allows a locally planted or modified GUP.exe updater binary to be accepted and launched even though its Authenticode digest is invalid, affecting versions 8.9.7 up to (but not including) 8.9.8 on Windows and fixed in 8.9.8. Exploitation is not remote and does not by itself yield remote code execution: it requires an attacker who already has the ability to replace or plant the updater-related file in the installation path (typically requiring elevated/admin rights for a default Program Files install, or a user-writable install directory), plus a victim who actively triggers the updater path (user interaction). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing); this is a code-signing verification defect rather than a directly reachable remote vulnerability.
Arbitrary code execution in Notepad++ prior to 8.9.8 on Windows 10 and Windows 11 occurs when the editor's 'Folder as Workspace' → 'Run by system' action resolves a sibling file instead of the path the user actually selected. If an attacker can place a script named after the selected text file with a .cmd extension appended (for example notes.txt.cmd next to notes.txt), invoking 'Run by system' on the text file causes that script to execute as the current user instead of opening the file. The flaw is local with a required, non-default user workflow (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8), and no public exploit identified at time of analysis; the vendor-released patch is Notepad++ 8.9.8.
Notepad++ installations prior to 8.9.8 crash when a local attacker can control the -settingsDir= command-line argument and points it at an abnormally long directory path. When Notepad++ subsequently saves its session, NppParameters::writeSession copies the derived session path into a fixed MAX_PATH stack buffer with unbounded wcscpy/wcscat calls and appends the session-backup suffix, overflowing the buffer; on protected release builds the stack canary halts the process, producing a denial of service rather than exploitable code execution. Exploitation requires local influence over launch arguments (for example a malicious shortcut or portable install) plus the victim actually launching Notepad++ and reaching a session-save, so default installations using normal-length settings directories are unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor's CVSS of 7.8 overstates impact given the assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L).
Loading a crafted Notepad++ plugin that reports more than 30 external lexers can overflow a 30-element stack array inside PluginsManager::loadPluginFromPath(), corrupting adjacent control data and potentially yielding arbitrary code execution in the Notepad++ process; the flaw affects all releases prior to 8.9.8. The attack is local and requires user interaction (the victim must install and load the malicious native plugin DLL), and because any loaded native plugin already runs in-process with full editor privileges, the incremental risk over simply distributing malicious plugin code is minimal - no public exploit identified at time of analysis, and the issue is not reachable remotely or through opened documents. Vendor-released patch: 8.9.8 (CVSS 8.6 base score; our assessment keeps the same 8.6 but treats scope as Unchanged rather than Changed).
Local code execution in Notepad++ before 8.9.6.1 occurs because the <GUIConfig name="commandLineInterpreter"> value in config.xml is loaded into _nppGUI._commandLineInterpreter with no validation, whitelist, or signature check, then passed directly to ShellExecute when a user invokes File → Open Containing Folder → cmd. An attacker who can plant or modify config.xml runs an arbitrary executable in the victim's session the next time they use this menu action. Publicly available exploit code exists (Exploit-DB 52606), but there is no public exploit identified as actively exploited; the issue is not in CISA KEV.
Local code execution in Notepad++ before 8.9.6.4 stems from a time-of-check/time-of-use race in NppCommands.cpp: the integrity HMAC of shortcuts.xml is verified against the on-disk file when a command fires, but the command payload is read from the _userCommands vector loaded at startup and never re-synced with disk. An attacker with write access to shortcuts.xml can plant a malicious version before launch and restore the legitimate file afterward, so the runtime HMAC check passes on the clean file while the malicious in-memory command executes. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; it is fixed in 8.9.6.4.
Local privilege escalation in the Notepad++ Windows installer (versions 8.9.4 through 8.9.5) lets an unprivileged local attacker gain the elevated privileges of the installer by planting a malicious powershell.exe. Because the installer calls powershell.exe by name (not absolute path) after setting the working directory to the installation contextMenu folder, a privileged user who installs into an attacker-writable custom directory triggers execution of the attacker's binary. No public exploit has been identified at time of analysis; the issue is fixed in 8.9.6 and corresponds to CWE-426 (Untrusted Search Path).
Local OS command injection in Notepad++ before 8.9.6.1 lets an attacker who can write to a user's shortcuts.xml inject an arbitrary executable path into a <Command> entry under <UserDefinedCommands>, which feedUserCmds() loads into UserCommand._cmd with no validation and later passes straight to ShellExecute when the victim clicks the corresponding Run-menu item. Because the malicious entry renders as an ordinary Run-menu item, it doubles as a stealthy persistence mechanism that executes attacker-chosen binaries in the victim's user context. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the fix is confirmed in release 8.9.6.1.
Trusted-directory validation bypass in Notepad++ 8.9.6.1 lets a crafted executable path defeat the isInTrustedDirectory() check added by the prior CVE-2026-48800 fix, allowing arbitrary code execution via the Run command. Because the check uses a prefix match (PathIsPrefix-style) without canonicalizing the path first, a string beginning with a trusted directory but containing ..\..\ traversal resolves to an untrusted location yet still passes validation, causing ShellExecute() to launch an attacker-controlled binary. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; it requires local user interaction and is fixed in 8.9.6.2.
Notepad++ versions before 8.9.2 allow local code execution through an unsafe search path vulnerability that permits attackers to hijack the Windows Explorer executable if they control the process working directory. A user with local access running the affected application could be tricked into executing a malicious explorer.exe, leading to arbitrary code execution with application privileges. Public exploit code exists for this vulnerability and no patch is currently available.
Notepad++ versions prior to 8.8.9 contain an update integrity verification vulnerability (CVE-2025-15556) when using the WinGUp updater. The update mechanism fails to cryptographically verify downloaded metadata and installers, allowing man-in-the-middle attackers to serve malicious executables during the update process. KEV-listed, this supply chain risk affects one of the most widely used text editors on Windows.
Denial of service and loss of unsaved work in Notepad++ versions prior to 8.9.8: a local process running at the same or a higher Windows integrity level on the same interactive desktop can send the NPPM_SAVESESSION window message with a null lParam, causing an immediate null-pointer dereference and termination of the editor. The flaw is rated CVSS 3.1 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning it requires a local low-privileged attacker process already present on the desktop, with no network vector, no user interaction, and impact limited to availability - no confidentiality or integrity compromise. Proof-of-concept level exploitation is indicated by SSVC (Exploitation: poc), and publicly available exploit code exists, but the issue is not confirmed as actively exploited in CISA KEV; the vendor-released patch is version 8.9.8.
Notepad++ releases prior to 8.9.8 enforce their shortcuts.xml HMAC integrity check on the Macro menu and keyboard-shortcut paths but omit it on the WM_MACRODLGRUNMACRO handler that powers the 'Run a Macro Multiple Times' dialog, so a tampered macro that is correctly blocked elsewhere still executes when invoked from that dialog. An attacker who can write to the current user's shortcuts.xml (for example later-stage malware, a tampered installer, or a low-integrity shared profile location) can plant a macro that calls internal Notepad++ commands, including commands that launch external programs, running entirely in that user's context with no privilege elevation. Exploitation is gated by local write access and by the victim opening the multi-run dialog; CVSS 3.1 rates it 6.7 (AV:L/AC:H/PR:L/UI:R), authentication requirements are authenticated for a local user per the provided vector (PR:L), and no public exploit identified at time of analysis. This is a genuine but low-urgency defense-bypass rather than a high-impact remote flaw.
Command injection in the Notepad++ Windows 11 x64 and ARM64 installer prior to version 8.9.7 allows an attacker who can influence the installation directory path to execute arbitrary PowerShell commands in the installer's security context. The vulnerable `RegisterMSIX` function in the NSIS installer script (`nppSetup.nsi`) unsafely interpolates the `$INSTDIR` variable into a PowerShell `-Command` string, enabling subexpression syntax such as `$()` embedded in a crafted directory name to be evaluated as live commands. Exploitation additionally requires that the user selects the optional Explorer context menu shell extension component during installation. The vendor has confirmed the fix in version 8.9.7; no public exploit or active exploitation has been identified at time of analysis.
Notepad++ versions prior to 8.9.6.1 can be crashed by any local process sharing the same interactive Windows session via a malformed WM_COPYDATA message. The COPYDATA_FULL_CMDLINE handler in NppBigSwitch.cpp dereferences COPYDATASTRUCT.lpData as an unbounded NUL-terminated wchar_t* without validating against the COPYDATASTRUCT.cbData length field, enabling an out-of-bounds read that results in process termination. No active exploitation has been confirmed (no CISA KEV listing, no public POC), and the fix is available in the vendor-released patch 8.9.6.1.
An Untrusted search path vulnerability in notepad++ 6.5 allows local users to gain escalated privileges through the msimg32.dll file in the current working directory. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as problematic was found in NotePad++ up to 8.1. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Notepad++ is a free and open-source source code editor. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Notepad++ is a free and open-source source code editor. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Notepad++ is a free and open-source source code editor. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Notepad++ is a free and open-source source code editor. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Notepad++ v8.4.1 was discovered to contain a stack overflow via the component Finder::add(). Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerable dll (UxTheme.dll) with his own dll and run arbitrary code in the context of Notepad++. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode characters in a crafted .ml file. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Improper signature verification in the Notepad++ updater path allows a locally planted or modified GUP.exe updater binary to be accepted and launched even though its Authenticode digest is invalid, affecting versions 8.9.7 up to (but not including) 8.9.8 on Windows and fixed in 8.9.8. Exploitation is not remote and does not by itself yield remote code execution: it requires an attacker who already has the ability to replace or plant the updater-related file in the installation path (typically requiring elevated/admin rights for a default Program Files install, or a user-writable install directory), plus a victim who actively triggers the updater path (user interaction). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing); this is a code-signing verification defect rather than a directly reachable remote vulnerability.
Arbitrary code execution in Notepad++ prior to 8.9.8 on Windows 10 and Windows 11 occurs when the editor's 'Folder as Workspace' → 'Run by system' action resolves a sibling file instead of the path the user actually selected. If an attacker can place a script named after the selected text file with a .cmd extension appended (for example notes.txt.cmd next to notes.txt), invoking 'Run by system' on the text file causes that script to execute as the current user instead of opening the file. The flaw is local with a required, non-default user workflow (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8), and no public exploit identified at time of analysis; the vendor-released patch is Notepad++ 8.9.8.
Notepad++ installations prior to 8.9.8 crash when a local attacker can control the -settingsDir= command-line argument and points it at an abnormally long directory path. When Notepad++ subsequently saves its session, NppParameters::writeSession copies the derived session path into a fixed MAX_PATH stack buffer with unbounded wcscpy/wcscat calls and appends the session-backup suffix, overflowing the buffer; on protected release builds the stack canary halts the process, producing a denial of service rather than exploitable code execution. Exploitation requires local influence over launch arguments (for example a malicious shortcut or portable install) plus the victim actually launching Notepad++ and reaching a session-save, so default installations using normal-length settings directories are unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor's CVSS of 7.8 overstates impact given the assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L).
Loading a crafted Notepad++ plugin that reports more than 30 external lexers can overflow a 30-element stack array inside PluginsManager::loadPluginFromPath(), corrupting adjacent control data and potentially yielding arbitrary code execution in the Notepad++ process; the flaw affects all releases prior to 8.9.8. The attack is local and requires user interaction (the victim must install and load the malicious native plugin DLL), and because any loaded native plugin already runs in-process with full editor privileges, the incremental risk over simply distributing malicious plugin code is minimal - no public exploit identified at time of analysis, and the issue is not reachable remotely or through opened documents. Vendor-released patch: 8.9.8 (CVSS 8.6 base score; our assessment keeps the same 8.6 but treats scope as Unchanged rather than Changed).
Local code execution in Notepad++ before 8.9.6.1 occurs because the <GUIConfig name="commandLineInterpreter"> value in config.xml is loaded into _nppGUI._commandLineInterpreter with no validation, whitelist, or signature check, then passed directly to ShellExecute when a user invokes File → Open Containing Folder → cmd. An attacker who can plant or modify config.xml runs an arbitrary executable in the victim's session the next time they use this menu action. Publicly available exploit code exists (Exploit-DB 52606), but there is no public exploit identified as actively exploited; the issue is not in CISA KEV.
Local code execution in Notepad++ before 8.9.6.4 stems from a time-of-check/time-of-use race in NppCommands.cpp: the integrity HMAC of shortcuts.xml is verified against the on-disk file when a command fires, but the command payload is read from the _userCommands vector loaded at startup and never re-synced with disk. An attacker with write access to shortcuts.xml can plant a malicious version before launch and restore the legitimate file afterward, so the runtime HMAC check passes on the clean file while the malicious in-memory command executes. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; it is fixed in 8.9.6.4.
Local privilege escalation in the Notepad++ Windows installer (versions 8.9.4 through 8.9.5) lets an unprivileged local attacker gain the elevated privileges of the installer by planting a malicious powershell.exe. Because the installer calls powershell.exe by name (not absolute path) after setting the working directory to the installation contextMenu folder, a privileged user who installs into an attacker-writable custom directory triggers execution of the attacker's binary. No public exploit has been identified at time of analysis; the issue is fixed in 8.9.6 and corresponds to CWE-426 (Untrusted Search Path).
Local OS command injection in Notepad++ before 8.9.6.1 lets an attacker who can write to a user's shortcuts.xml inject an arbitrary executable path into a <Command> entry under <UserDefinedCommands>, which feedUserCmds() loads into UserCommand._cmd with no validation and later passes straight to ShellExecute when the victim clicks the corresponding Run-menu item. Because the malicious entry renders as an ordinary Run-menu item, it doubles as a stealthy persistence mechanism that executes attacker-chosen binaries in the victim's user context. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the fix is confirmed in release 8.9.6.1.
Trusted-directory validation bypass in Notepad++ 8.9.6.1 lets a crafted executable path defeat the isInTrustedDirectory() check added by the prior CVE-2026-48800 fix, allowing arbitrary code execution via the Run command. Because the check uses a prefix match (PathIsPrefix-style) without canonicalizing the path first, a string beginning with a trusted directory but containing ..\..\ traversal resolves to an untrusted location yet still passes validation, causing ShellExecute() to launch an attacker-controlled binary. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; it requires local user interaction and is fixed in 8.9.6.2.
Notepad++ versions before 8.9.2 allow local code execution through an unsafe search path vulnerability that permits attackers to hijack the Windows Explorer executable if they control the process working directory. A user with local access running the affected application could be tricked into executing a malicious explorer.exe, leading to arbitrary code execution with application privileges. Public exploit code exists for this vulnerability and no patch is currently available.
Notepad++ versions prior to 8.8.9 contain an update integrity verification vulnerability (CVE-2025-15556) when using the WinGUp updater. The update mechanism fails to cryptographically verify downloaded metadata and installers, allowing man-in-the-middle attackers to serve malicious executables during the update process. KEV-listed, this supply chain risk affects one of the most widely used text editors on Windows.
Denial of service and loss of unsaved work in Notepad++ versions prior to 8.9.8: a local process running at the same or a higher Windows integrity level on the same interactive desktop can send the NPPM_SAVESESSION window message with a null lParam, causing an immediate null-pointer dereference and termination of the editor. The flaw is rated CVSS 3.1 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning it requires a local low-privileged attacker process already present on the desktop, with no network vector, no user interaction, and impact limited to availability - no confidentiality or integrity compromise. Proof-of-concept level exploitation is indicated by SSVC (Exploitation: poc), and publicly available exploit code exists, but the issue is not confirmed as actively exploited in CISA KEV; the vendor-released patch is version 8.9.8.
Notepad++ releases prior to 8.9.8 enforce their shortcuts.xml HMAC integrity check on the Macro menu and keyboard-shortcut paths but omit it on the WM_MACRODLGRUNMACRO handler that powers the 'Run a Macro Multiple Times' dialog, so a tampered macro that is correctly blocked elsewhere still executes when invoked from that dialog. An attacker who can write to the current user's shortcuts.xml (for example later-stage malware, a tampered installer, or a low-integrity shared profile location) can plant a macro that calls internal Notepad++ commands, including commands that launch external programs, running entirely in that user's context with no privilege elevation. Exploitation is gated by local write access and by the victim opening the multi-run dialog; CVSS 3.1 rates it 6.7 (AV:L/AC:H/PR:L/UI:R), authentication requirements are authenticated for a local user per the provided vector (PR:L), and no public exploit identified at time of analysis. This is a genuine but low-urgency defense-bypass rather than a high-impact remote flaw.
Command injection in the Notepad++ Windows 11 x64 and ARM64 installer prior to version 8.9.7 allows an attacker who can influence the installation directory path to execute arbitrary PowerShell commands in the installer's security context. The vulnerable `RegisterMSIX` function in the NSIS installer script (`nppSetup.nsi`) unsafely interpolates the `$INSTDIR` variable into a PowerShell `-Command` string, enabling subexpression syntax such as `$()` embedded in a crafted directory name to be evaluated as live commands. Exploitation additionally requires that the user selects the optional Explorer context menu shell extension component during installation. The vendor has confirmed the fix in version 8.9.7; no public exploit or active exploitation has been identified at time of analysis.
Notepad++ versions prior to 8.9.6.1 can be crashed by any local process sharing the same interactive Windows session via a malformed WM_COPYDATA message. The COPYDATA_FULL_CMDLINE handler in NppBigSwitch.cpp dereferences COPYDATASTRUCT.lpData as an unbounded NUL-terminated wchar_t* without validating against the COPYDATASTRUCT.cbData length field, enabling an out-of-bounds read that results in process termination. No active exploitation has been confirmed (no CISA KEV listing, no public POC), and the fix is available in the vendor-released patch 8.9.6.1.
An Untrusted search path vulnerability in notepad++ 6.5 allows local users to gain escalated privileges through the msimg32.dll file in the current working directory. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as problematic was found in NotePad++ up to 8.1. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Notepad++ is a free and open-source source code editor. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Notepad++ is a free and open-source source code editor. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Notepad++ is a free and open-source source code editor. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Notepad++ is a free and open-source source code editor. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Notepad++ v8.4.1 was discovered to contain a stack overflow via the component Finder::add(). Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerable dll (UxTheme.dll) with his own dll and run arbitrary code in the context of Notepad++. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode characters in a crafted .ml file. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.