CVE-2026-85288

The open-source source code editor Notepad++ is vulnerable in versions prior to 8.9.8 due to incomplete shortcuts.xml HMAC validation . The WM_MACRODLGRUNMACRO entry point (Run a Macro Multiple Times) calls macroPlayback() without the validation applied by command() . This allows a tampered macro...

CVE-2026-85288 Notepad++: Shortcuts.xml macro HMAC bypass still reachable via the "Run a Macro Multiple Times" dialog

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortcuts.xml HMAC validation because WMMACRODLGRUNMACRO, the Run a Macro Multiple Times entry point, calls macroPlayback without the validation used by command. A tampered shortcuts.xml macro...

EUVD-2026-84570

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in PluginsManager::loadPluginFromPath in PowerEditor/src/MISC/PluginsManager/PluginsManager.cpp because the plugin-supplied GetLexerCount result controls a loop that writes to...

CVE-2026-85279 Notepad++: Stack Buffer Overflow in Plugin Lexer Loading via Unchecked GetLexerCount() Return Value

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in PluginsManager::loadPluginFromPath in PowerEditor/src/MISC/PluginsManager/PluginsManager.cpp because the plugin-supplied GetLexerCount result controls a loop that writes to...

CVE-2026-85279 Notepad++: Stack Buffer Overflow in Plugin Lexer Loading via Unchecked GetLexerCount() Return Value

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in PluginsManager::loadPluginFromPath in PowerEditor/src/MISC/PluginsManager/PluginsManager.cpp because the plugin-supplied GetLexerCount result controls a loop that writes to...

CVE-2026-85279

The source code editor Notepad++ contains a stack buffer overflow in the PluginsManager::loadPluginFromPath function within PowerEditor/src/MISC/PluginsManager/PluginsManager.cpp. This vulnerability exists because the application fails to enforce NB_MAX_EXTERNAL_LANG when processing the plugin-su...

CVE-2026-85279 Notepad++: Stack Buffer Overflow in Plugin Lexer Loading via Unchecked GetLexerCount() Return Value

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in PluginsManager::loadPluginFromPath in PowerEditor/src/MISC/PluginsManager/PluginsManager.cpp because the plugin-supplied GetLexerCount result controls a loop that writes to...

CVE-2026-85995: Improper Verification of Cryptographic Signature

Notepad++ is a free and open-source source code editor. From 8.9.7 until 8.9.8, the Notepad++ updater and signature verification path can accept a modified GUP.exe file whose embedded certificate metadata remains present even though its Authenticode digest is invalid. An attacker who can replace ...

PT-2026-96853

Name of the Vulnerable Software and Affected Versions Notepad++ versions prior to 8.9.8 Description The NPPM SAVESESSION handler in PowerEditor/src/NppBigSwitch.cpp converts lParam to a sessionInfo pointer and dereferences its nbFile, files, and sessionFilePathName members without checking for...

PT-2026-96852

Name of the Vulnerable Software and Affected Versions Notepad++ versions prior to 8.9.8 Description A stack buffer overflow exists in the NppParameters::writeSession function within PowerEditor/src/Parameters.cpp. The issue occurs when the software copies a session path derived from the...

PT-2026-96851

Name of the Vulnerable Software and Affected Versions Notepad++ versions 8.9.7 through 8.9.7 Description The updater and signature verification path can accept a modified GUP.exe file. This occurs because the system accepts the file if embedded certificate metadata is present, even if the...

CVE-2026-86054: Stack-based Buffer Overflow

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in NppParameters::writeSession in PowerEditor/src/Parameters.cpp because it copies a session path derived from -settingsDir= into backupPathNameMAXPATH with unbounded wcscpy and...

PT-2026-96842

Name of the Vulnerable Software and Affected Versions Notepad++ versions prior to 8.9.8 Description The Folder as Workspace Run by system action can resolve a sibling file different from the one selected by the user. On Windows 10 or Windows 11, if an attacker places a command script with the sam...

PT-2026-96850

Name of the Vulnerable Software and Affected Versions Notepad++ versions prior to 8.9.8 Description Notepad++ incompletely enforces HMAC Hash-based Message Authentication Code validation for the shortcuts.xml file. The issue occurs because the WM MACRODLGRUNMACRO entry point, used for running a...

CVE-2026-85279: Stack-based Buffer Overflow

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in PluginsManager::loadPluginFromPath in PowerEditor/src/MISC/PluginsManager/PluginsManager.cpp because the plugin-supplied GetLexerCount result controls a loop that writes to...

CVE-2026-77605: Improper Input Validation

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the Folder as Workspace Run by system action in Notepad++ can resolve a different sibling file than the file selected by the user. When an attacker places a command script whose name is the selected text-file path with .cmd...

CVE-2026-85288: Improper Neutralization of Special Elements used in an OS Command

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortcuts.xml HMAC validation because WMMACRODLGRUNMACRO, the Run a Macro Multiple Times entry point, calls macroPlayback without the validation used by command. A tampered shortcuts.xml macro...

CVE-2026-86056: NULL Pointer Dereference

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the NPPMSAVESESSION handler in PowerEditor/src/NppBigSwitch.cpp converts lParam to a sessionInfo pointer and dereferences its nbFile, files, and sessionFilePathName members without checking for null. A process running at the...

PT-2026-90780

Name of the Vulnerable Software and Affected Versions Notepad++ versions prior to 8.9.8 Description A stack buffer overflow exists in the plugin loading mechanism within the PluginsManager::loadPluginFromPath function. The issue occurs because the result of the GetLexerCount function, provided by...

CVE-2026-71858

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, macros loaded from an attacker-controlled shortcuts.xml bypass the HMAC validation applied to UserDefinedCommands and can invoke Scintilla actions and the internal Open in Default Viewer command in an elevated Notepad++...