notepad-plus-plus vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20234
3. 20251
4. 202619

Known exploitedNewest addition to KEV first

• CVE-2025-15556

  Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification

  notepad-plus-plus · notepad-plus-plus

  ExploitedHigh7.7

Newest CVEs

• CVE-2026-85995

  Notepad++: Authenticode verification bypass allows modified updater execution

  notepad-plus-plus · notepad-plus-plus

  High7.3
• CVE-2026-86056

  Notepad++: Null pointer dereference in NPPM_SAVESESSION message handler causes crash (DoS)

  notepad-plus-plus · notepad-plus-plus

  Medium5.5
• CVE-2026-77605

  Notepad++ “Run by system” executes *.txt.cmd when user selected *.txt (target confusion → command execution)

  notepad-plus-plus · notepad-plus-plus

  High7.8
• CVE-2026-86054

  Notepad++: Stack Buffer Overflow in `NppParameters::writeSession` via overlong session path

  notepad-plus-plus · notepad-plus-plus

  High7.8
• CVE-2026-85288

  Notepad++: Shortcuts.xml macro HMAC bypass still reachable via the "Run a Macro Multiple Times" dialog

  notepad-plus-plus · notepad-plus-plus

  Medium6.7
• CVE-2026-85279

  Notepad++: Stack Buffer Overflow in Plugin Lexer Loading via Unchecked GetLexerCount() Return Value

  notepad-plus-plus · notepad-plus-plus

  High8.6
• CVE-2026-57233

  Notepad++: Path Traversal (Zip Slip) in WinGup Plugin Extraction

  notepad-plus-plus · notepad-plus-plus

  High8.1
• CVE-2026-52886

  Notepad++: session.xml backupFilePath starts_with Bypass

  notepad-plus-plus · notepad-plus-plus

  Medium5.1
• CVE-2026-71858

  Notepad++: shortcuts.xml Macro HMAC Bypass Enables Conditional Elevated Command Execution

  notepad-plus-plus · notepad-plus-plus

  Medium5.4
• CVE-2026-54758

  Notepad++: Stack Buffer Overflow in expandNppEnvironmentStrs

  notepad-plus-plus · notepad-plus-plus

  High7.8