SB2026052685 - Multiple vulnerabilities in Notepad++

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026052685

SB2026052685 - Multiple vulnerabilities in Notepad++

Published: May 26, 2026 Updated: August 24, 2026

Security Bulletin ID SB2026052685
CSH Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 60% Medium 20% Low 20%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Out-of-bounds read (CVE-ID: CVE-2026-48770)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local process to cause a denial of service.

The vulnerability exists due to out-of-bounds read in the WM_COPYDATA COPYDATA_FULL_CMDLINE handler when processing a malformed WM_COPYDATA message. A local process can send a specially crafted IPC message to cause a denial of service.

User interaction is required to have Notepad++ open in the same interactive Windows session.


2) OS Command Injection (CVE-ID: CVE-2026-48778)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to command injection in the config.xml commandLineInterpreter handling when opening the containing folder in cmd. A remote attacker can supply a crafted config.xml value to execute arbitrary code.

User interaction is required to trigger the File → Open Containing Folder → cmd action.


3) OS Command Injection (CVE-ID: CVE-2026-48800)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to command injection in the shortcuts.xml UserCommand handling when processing attacker-controlled command entries and the user clicks the corresponding Run menu item. A remote attacker can place a crafted command in shortcuts.xml to execute arbitrary code.

User interaction is required to click the injected Run menu entry, and the malicious entry may appear as a legitimate-looking menu item.


4) External Control of File Name or Path (CVE-ID: N/A)

CWE-ID: CWE-73 - External Control of File Name or Path

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to external control of file name or path in the session file parser when processing crafted session files containing UNC paths. A remote attacker can trick the victim into opening a crafted session file to disclose sensitive information.

User interaction is required to open the crafted session file, and exploitation on Windows causes automatic SMB authentication to an attacker-controlled server.


5) Stack-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to stack-based buffer overflow in PluginsManager::loadPluginFromPath() when loading a plugin DLL and processing the exported GetLexerCount() return value. A remote attacker can place a specially crafted plugin DLL that returns a value greater than 30 to execute arbitrary code.

User interaction is required to start Notepad++ after the malicious plugin is installed.


Remediation

Install update from vendor's website.

References