SB20260824260 - Multiple vulnerabilities in Notepad++

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260824260

SB20260824260 - Multiple vulnerabilities in Notepad++

Published: August 24, 2026 Updated: August 24, 2026

Security Bulletin ID SB20260824260
CSH Severity
High
Patch available
YES
Number of vulnerabilities 13
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 8% Medium 85% Low 8%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 13 vulnerabilities.


1) OS Command Injection (CVE-ID: N/A)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to command injection in the MSI installer RunOnce PowerShell command when processing a crafted INSTALLFOLDER value or MSI transform during installation. A local user can supply a specially crafted installation path to execute arbitrary code.

User interaction is required because an administrator must perform the crafted installation, and the injected code runs at the next logon in the logging-on user\'s RunOnce context rather than automatically as SYSTEM.


2) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper input validation in session file loading for FileBrowser root enumeration when processing a crafted .npp-session file containing a UNC path in the foldername attribute. A remote attacker can trick the victim into opening a crafted session file to disclose sensitive information.

Windows may automatically perform NTLM authentication to an attacker-controlled SMB server, and user interaction is required to load the crafted session file.


3) Improper privilege management (CVE-ID: N/A)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to execute arbitrary code with administrator privileges.

The vulnerability exists due to improper privilege management in the WM_COMMAND handling for user-defined commands when sending a crafted WM_COMMAND message to an elevated Notepad++ instance after forging the HMAC protecting shortcuts.xml. A local user can send a crafted WM_COMMAND message that triggers a forged user-defined command to execute arbitrary code with administrator privileges.

User interaction is required to have an elevated Notepad++ instance running.


4) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to heap-based buffer overflow in Utf8_16_Read::convert() when parsing a crafted UTF-16 file during normal file loading. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.

User interaction is required to open the crafted document, and the issue is triggered when a UTF-16 surrogate pair is split across fixed-size file-read blocks.


5) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: N/A)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to execute arbitrary code with administrator privileges.

The vulnerability exists due to a time-of-check time-of-use race condition in WinGup updater installer handling when verifying a downloaded installer by path and launching it after a user approval dialog. A local user can replace the verified installer file in %TEMP% before it is executed to execute arbitrary code with administrator privileges.

User interaction is required to perform a routine update and approve the resulting UAC prompt.


6) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in User-Defined-Language \"Comment\" keyword handling when processing a crafted UDL definition in the \"Define your language\" dialog. A local user can import or place a specially crafted UDL XML file and select the malicious language definition to cause a denial of service.

User interaction is required to open the dialog and select the malicious language definition.


7) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to exposure of sensitive information to an unauthorized actor in workspace path handling and custom toolbar path processing when parsing a crafted workspace file or loading a crafted toolbar configuration. A remote attacker can supply UNC paths that trigger automatic path probes to disclose sensitive information.

User interaction is required to open the crafted workspace for the primary attack path.


8) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in workspace path handling and custom toolbar path processing when parsing a crafted workspace file or loading a crafted toolbar configuration containing many delayed UNC paths. A remote attacker can supply many distinct network paths to cause a denial of service.

The GUI thread waits synchronously for each probe, and the cumulative blocking time grows with the number of distinct delayed targets.


9) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to delete or overwrite files outside the intended backup directory.

The vulnerability exists due to path traversal in session.xml backupFilePath handling when loading a supplied session file and later processing backup file paths during save or close operations. A local user can place a crafted session.xml in the Notepad++ settings directory to delete or overwrite files outside the intended backup directory.

User interaction is required to open Notepad++ and save or close the restored document, and the delete target must already exist.


10) Improper Verification of Cryptographic Signature (CVE-ID: N/A)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to execute modified code through the trusted updater launch path.

The vulnerability exists due to improper verification of cryptographic signature in the updater signature verification path when launching updater-related binaries from the GUI updater path. A local user can place or replace a modified updater-related binary that retains certificate metadata but has an invalid Authenticode digest to execute modified code through the trusted updater launch path.

User interaction is required to trigger the updater path from the GUI.


11) Insufficient verification of data authenticity (CVE-ID: N/A)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to execute arbitrary commands.

The vulnerability exists due to insufficient verification of data authenticity in the shortcuts.xml macro playback path when running a tampered macro through the \"Run a Macro Multiple Times\" dialog. A local user can supply a crafted shortcuts.xml macro and trigger it through the dialog to execute arbitrary commands.

User interaction is required to run the macro through the dialog.


12) NULL pointer dereference (CVE-ID: N/A)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to null pointer dereference in the NPPM_SAVESESSION message handler in PowerEditor/src/NppBigSwitch.cpp when handling a crafted NPPM_SAVESESSION message with a null lParam pointer. A local user can send a specially crafted message to cause a denial of service.

The issue can result in loss of unsaved document data.


13) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.8 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to exposure of sensitive information to an unauthorized actor in the clickable link handling feature when processing a user-clicked file:// link in an opened document. A remote attacker can provide a specially crafted text file containing a file:// link to disclose sensitive information.

User interaction is required to click the crafted link, and the issue occurs in the default configuration on Windows.


Remediation

Install update from vendor's website.

References