CVE-2026-86056: NULL Pointer Dereference

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the NPPMSAVESESSION handler in PowerEditor/src/NppBigSwitch.cpp converts lParam to a sessionInfo pointer and dereferences its nbFile, files, and sessionFilePathName members without checking for null. A process running at the...

CVE-2026-85279: Stack-based Buffer Overflow

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in PluginsManager::loadPluginFromPath in PowerEditor/src/MISC/PluginsManager/PluginsManager.cpp because the plugin-supplied GetLexerCount result controls a loop that writes to...

CVE-2026-77605: Improper Input Validation

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the Folder as Workspace Run by system action in Notepad++ can resolve a different sibling file than the file selected by the user. When an attacker places a command script whose name is the selected text-file path with .cmd...

CVE-2026-85288: Improper Neutralization of Special Elements used in an OS Command

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortcuts.xml HMAC validation because WMMACRODLGRUNMACRO, the Run a Macro Multiple Times entry point, calls macroPlayback without the validation used by command. A tampered shortcuts.xml macro...

PT-2026-90780

My 4th official CVE is now assigned: 🔐 Notepad++ 🐞 Stack-based Buffer Overflow ⚠️ High Severity 💥 CVE-2026-85279 A vulnerability in the plugin loading mechanism leading to potential arbitrary code execution. The comeback continues. 🗿🔥 CyberSecurity CVE BugBounty https://t.co/RiRptj80NP...

CVE-2026-71858

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, macros loaded from an attacker-controlled shortcuts.xml bypass the HMAC validation applied to UserDefinedCommands and can invoke Scintilla actions and the internal Open in Default Viewer command in an elevated Notepad++...

CVE-2026-57233

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and...

CVE-2026-52886

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::startswith against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode...

CVE-2026-54758

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the expandNppEnvironmentStrs function in PowerEditor/src/WinControls/StaticDialog/RunDlg/RunDlg.cpp copies a Notepad++ variable name between $ and into the fixed-size wchart strMAXPATH stack buffer without bounding the m loop...

CVE-2026-57233 Notepad++: Path Traversal (Zip Slip) in WinGup Plugin Extraction

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and...

CVE-2026-57233

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and...

CVE-2026-57233 Notepad++: Path Traversal (Zip Slip) in WinGup Plugin Extraction

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and...

CVE-2026-57233 Notepad++: Path Traversal (Zip Slip) in WinGup Plugin Extraction

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and...

CVE-2026-57233

In Notepad++ prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to the extraction destination without canonical containment validation, enabling a Zip Slip attack. A crafted entry like ../mimeTools/mimeTools.dll overwrites a sibling plugin DLL, achieving arbitrary code...

EUVD-2026-60375

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and...

CVE-2026-52886

Notepad++ versions before 8.9.7 use std::wstring::starts_with to validate the backupFilePath attribute in session.xml during snapshot-mode restoration without path normalization, allowing .. sequences to read arbitrary user-readable files outside the backup directory into an editor tab. CVSS 5.1 ...

CVE-2026-52886

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::startswith against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode...

CVE-2026-52886 Notepad++: session.xml backupFilePath starts_with Bypass

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::startswith against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode...

CVE-2026-52886 Notepad++: session.xml backupFilePath starts_with Bypass

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::startswith against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode...

CVE-2026-52886 Notepad++: session.xml backupFilePath starts_with Bypass

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::startswith against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode...