Notepad-plus-plus vulnerabilities
25 CVEs and advisories name Notepad-plus-plus as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-85995Notepad++: Authenticode verification bypass allows modified updater execution
- CVE-2026-86056Notepad++: Null pointer dereference in NPPM_SAVESESSION message handler causes crash (DoS)
- CVE-2026-77605Notepad++ “Run by system” executes *.txt.cmd when user selected *.txt (target confusion → command execution)
- CVE-2026-86054Notepad++: Stack Buffer Overflow in `NppParameters::writeSession` via overlong session path
- CVE-2026-85288Notepad++: Shortcuts.xml macro HMAC bypass still reachable via the "Run a Macro Multiple Times" dialog
- CVE-2026-85279Notepad++: Stack Buffer Overflow in Plugin Lexer Loading via Unchecked GetLexerCount() Return Value
- CVE-2026-57233Notepad++: Path Traversal (Zip Slip) in WinGup Plugin Extraction
- CVE-2026-52886Notepad++: session.xml backupFilePath starts_with Bypass
- CVE-2026-71858Notepad++: shortcuts.xml Macro HMAC Bypass Enables Conditional Elevated Command Execution
- CVE-2026-54758Notepad++: Stack Buffer Overflow in expandNppEnvironmentStrs
- CVE-2026-73250Notepad++: Install-time PowerShell command injection through installation path
- CVE-2026-48770Notepad++ WM_COPYDATA COPYDATA_FULL_CMDLINE local DoS crash
- CVE-2026-48778Notepad++: Arbitrary Code Execution via config.xml commandLineInterpreter
- CVE-2026-52885Notepad++ TOCTOU: HMAC Checks Disk, Executes from Memory
- CVE-2026-46710Notepad++: Privilege Escalation in the Installer via Uncontrolled Executable Search Path
- CVE-2026-48800Notepad++: Arbitrary Code Execution via shortcuts.xml UserCommand Injection
- CVE-2026-52884Notepad++: CVE-2026-48800 Bypass
- CVE-2026-25926Notepad++ has an Untrusted Search Path
- CVE-2025-15556Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification
- CVE-2025-49144Notepad++ Privilege Escalation in Installer via Uncontrolled Executable Search Path
- CVE-2023-40166Notepad++ heap buffer read overflow in FileManager::detectLanguageFromTextBegining
- CVE-2023-40164Notepad++ global buffer read overflow in nsCodingStateMachine::NextState
- CVE-2023-40036Notepad++ global buffer read overflow in CharDistributionAnalysis::HandleOneChar
- CVE-2023-40031Notepad++ vulnerable to heap buffer write overflow in Utf8_16_Read::convert
- CVE-2022-32168notepad-plus-plus - DLL Hijacking