Notepad-plus-plus vulnerabilities

Products

• Notepad-plus-plus 25
• Notepad\+\+ 20

Newest

• notepad-plus-plus Notepad++: Authenticode verification bypass allows modified updater execution CVE-2026-85995 7.3 HighSeptember 22, 2026
• notepad-plus-plus Notepad++: Null pointer dereference in NPPM_SAVESESSION message handler causes crash (DoS) CVE-2026-86056 5.5 MediumSeptember 22, 2026
• notepad-plus-plus Notepad++ “Run by system” executes *.txt.cmd when user selected *.txt (target confusion → command execution) CVE-2026-77605 7.8 HighSeptember 22, 2026
• notepad-plus-plus Notepad++: Stack Buffer Overflow in `NppParameters::writeSession` via overlong session path CVE-2026-86054 7.8 HighSeptember 22, 2026
• notepad-plus-plus Notepad++: Shortcuts.xml macro HMAC bypass still reachable via the "Run a Macro Multiple Times" dialog CVE-2026-85288 6.7 MediumSeptember 22, 2026
• notepad-plus-plus Notepad++: Stack Buffer Overflow in Plugin Lexer Loading via Unchecked GetLexerCount() Return Value CVE-2026-85279 8.6 HighSeptember 22, 2026
• notepad-plus-plus Notepad++: Path Traversal (Zip Slip) in WinGup Plugin Extraction CVE-2026-57233 8.1 HighAugust 17, 2026
• notepad-plus-plus Notepad++: session.xml backupFilePath starts_with Bypass CVE-2026-52886 Public exploit 5.1 MediumAugust 17, 2026
• notepad-plus-plus Notepad++: shortcuts.xml Macro HMAC Bypass Enables Conditional Elevated Command Execution CVE-2026-71858 5.4 MediumAugust 17, 2026
• notepad-plus-plus Notepad++: Stack Buffer Overflow in expandNppEnvironmentStrs CVE-2026-54758 7.8 HighAugust 17, 2026
• notepad-plus-plus Notepad++: Install-time PowerShell command injection through installation path CVE-2026-73250 5.4 MediumAugust 11, 2026
• notepad-plus-plus, notepad-plus-plus notepad\+\+ +1 more Notepad++ WM_COPYDATA COPYDATA_FULL_CMDLINE local DoS crash CVE-2026-48770 Public exploit 5.0 MediumJune 26, 2026
• notepad-plus-plus, notepad-plus-plus notepad\+\+ +1 more Notepad++: Arbitrary Code Execution via config.xml commandLineInterpreter CVE-2026-48778 Public exploit 7.8 HighJune 26, 2026
• notepad-plus-plus, notepad-plus-plus notepad\+\+ +1 more Notepad++ TOCTOU: HMAC Checks Disk, Executes from Memory CVE-2026-52885 Public exploit 7.5 HighJune 26, 2026
• notepad-plus-plus, notepad-plus-plus notepad\+\+ +1 more Notepad++: Privilege Escalation in the Installer via Uncontrolled Executable Search Path CVE-2026-46710 7.5 HighJune 26, 2026
• notepad-plus-plus, notepad-plus-plus notepad\+\+ +1 more Notepad++: Arbitrary Code Execution via shortcuts.xml UserCommand Injection CVE-2026-48800 Public exploit 7.8 HighJune 26, 2026
• notepad-plus-plus, notepad-plus-plus notepad\+\+ +1 more Notepad++: CVE-2026-48800 Bypass CVE-2026-52884 7.8 HighJune 26, 2026
• notepad++, notepad-plus-plus notepad\+\+ +1 more Notepad++ 8.9.3 Format String Injection via nativeLang.xml CVE-2026-6539 4.6 MediumApril 30, 2026
• notepad++, notepad-plus-plus notepad\+\+ +1 more Stack-Based Buffer Overflow in Notepad++ File Drop Handler leads to DoS CVE-2026-5525 6.0 MediumApril 10, 2026
• notepad-plus-plus, notepad-plus-plus notepad\+\+ +1 more Notepad++ has an Untrusted Search Path CVE-2026-25926 7.3 HighFebruary 18, 2026
• notepad++, notepad-plus-plus, notepad-plus-plus notepad\+\+ +2 more Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification CVE-2025-15556 In KEVPublic exploit 7.7 HighFebruary 3, 2026
• notepad-plus-plus Notepad++ Privilege Escalation in Installer via Uncontrolled Executable Search Path CVE-2025-49144 Public exploit 7.3 HighJune 23, 2025
• notepad++, notepad-plus-plus notepad\+\+ +1 more NotePad++ dbghelp.exe uncontrolled search path CVE-2023-6401 Public exploit 5.3 MediumNovember 30, 2023
• notepad-plus-plus notepad\+\+ An Untrusted search path vulnerability in notepad++ 6.5 allows local users to gain escalated... CVE-2023-47452 7.8 HighNovember 30, 2023
• notepad-plus-plus, notepad-plus-plus notepad\+\+ +1 more Notepad++ heap buffer read overflow in FileManager::detectLanguageFromTextBegining CVE-2023-40166 5.5 MediumAugust 25, 2023
• notepad-plus-plus, notepad-plus-plus notepad\+\+ +1 more Notepad++ global buffer read overflow in nsCodingStateMachine::NextState CVE-2023-40164 5.5 MediumAugust 25, 2023
• notepad-plus-plus, notepad-plus-plus notepad\+\+ +1 more Notepad++ global buffer read overflow in CharDistributionAnalysis::HandleOneChar CVE-2023-40036 5.5 MediumAugust 25, 2023
• notepad-plus-plus, notepad-plus-plus notepad\+\+ +1 more Notepad++ vulnerable to heap buffer write overflow in Utf8_16_Read::convert CVE-2023-40031 Public exploit 7.8 HighAugust 25, 2023
• notepad-plus-plus notepad\+\+ Notepad++ v8.4.1 was discovered to contain a stack overflow via the component Finder::add(). CVE-2022-31902 Public exploit 5.5 MediumFebruary 1, 2023
• notepad-plus-plus notepad\+\+ Buffer overflow in function Notepad_plus::addHotSpot in Notepad++ v8.4.3 and earlier allows... CVE-2022-31901 Public exploit 6.5 MediumJanuary 19, 2023
• notepad-plus-plus, notepad-plus-plus notepad\+\+ +1 more notepad-plus-plus - DLL Hijacking CVE-2022-32168 7.8 HighSeptember 28, 2022
• scintilla, notepad-plus-plus notepad\+\+ +1 more SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of... CVE-2019-16294 Public exploit 7.8 HighSeptember 14, 2019