Notepad-plus-plus vulnerabilities
We track 16 vulnerabilities in Notepad-plus-plus products across 2 products. 16 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on September 22, 2026.
Latest Notepad-plus-plus vulnerabilities
- 7.8 High severity
notepad-plus-plus: Stack-based Buffer Overflow
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in NppParameters::writeSession in PowerEditor/src/Parameters.cpp because it copies a session path derived from -settingsDir= into backupPathName[
- 7.3 High severity
notepad-plus-plus: Improper Verification of Cryptographic Signature
Notepad++ is a free and open-source source code editor. From 8.9.7 until 8.9.8, the Notepad++ updater and signature verification path can accept a modified GUP.exe file whose embedded certificate metadata remains present even though its Authenticode digest is
- 8.6 High severity
notepad-plus-plus: Stack-based Buffer Overflow
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in PluginsManager::loadPluginFromPath in PowerEditor/src/MISC/PluginsManager/PluginsManager.cpp because the plugin-supplied GetLexerCount() resul
- 7.8 High severity
Notepad++ is a free and open-source source code editor.
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the Folder as Workspace Run by system action in Notepad++ can resolve a different sibling file than the file selected by the user. When an attacker places a command script whose name is th
- 8.1 High severity
notepad-plus-plus: Improper Limitation of a Pathname to a Restricted Directory
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a
- 7.8 High severity
notepad-plus-plus: Stack-based Buffer Overflow
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the expandNppEnvironmentStrs function in PowerEditor/src/WinControls/StaticDialog/RunDlg/RunDlg.cpp copies a Notepad++ variable name between $( and ) into the fixed-size wchar_t str[MAX_PA
- 7.8 High severity
notepad-plus-plus: Path Equivalence: 'filename.' (Trailing Dot)
Notepad++ is a free and open-source source code editor. In v8.9.6.1, isInTrustedDirectory() does NOT canonicalize the path before checking. It uses a prefix-based check (PathIsPrefix() or equivalent) that matches paths starting with trusted directory strings.
- 7.8 High severity
notepad-plus-plus: Improper Neutralization of Special Elements used in an OS Command
Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <Command> tag text content inside <UserDefinedCommands> in shortcuts.xml is read by NppXml::value(aNode) (Parameters.cpp:3658) in the feedUserCmds() function and stored in UserComman
- 7.8 High severity
notepad-plus-plus: Improper Neutralization of Special Elements used in an OS Command
Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <GUIConfig name="commandLineInterpreter"> tag in config.xml is read by NppXml::value() (Parameters.cpp:6430) and stored in _nppGUI._commandLineInterpreter without any validation, whi
- 7.8 High severity
notepad-plus-plus: Untrusted Search Path
Notepad++ is a free and open-source source code editor. From 8.9.4 until 8.9.6, Notepad++ contains a local privilege escalation vulnerability in the installer. During installation, the installer invokes powershell.exe without using an absolute path after setti
- 7.3 High severity
notepad-plus-plus: Untrusted Search Path
Notepad++ is a free and open-source source code editor. An Unsafe Search Path vulnerability (CWE-426) exists in versions prior to 8.9.2 when launching Windows Explorer without an absolute executable path. This may allow execution of a malicious explorer.exe if
- 7.5 High severity
Notepad++ Download of Code Without Integrity Check Exploited
Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically verified. An attacker able to intercept or redirect update traffi
- 7.3 High severity
notepad-plus-plus: Least Privilege Violation
Notepad++ is a free and open-source source code editor. In versions 8.8.1 and prior, a privilege escalation vulnerability exists in the Notepad++ v8.8.1 installer that allows unprivileged users to gain SYSTEM-level privileges through insecure executable search
- 7.8 High severity
Notepad++: Uncontrolled Search Path Element
An Untrusted search path vulnerability in notepad++ 6.5 allows local users to gain escalated privileges through the msimg32.dll file in the current working directory.
- 7.8 High severity
notepad-plus-plus: Buffer Copy without Checking Size of Input
Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to heap buffer write overflow in `Utf8_16_Read::convert`. This issue may lead to arbitrary code execution. As of time of publication, no known patches are available
- 7.8 High severity
notepad-plus-plus: Uncontrolled Search Path Element
Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerable dll (UxTheme.dll) with his own dll and run arbitrary code in the context of Notepad++.