Notepad++ Vulnerability History and How to Stay Safe

Notepad++ has had a rough stretch since 2025, and it isn’t one bug. The installer had a binary planting flaw (CVE-2025-49144). Separately, the WinGUp updater skipped an integrity check (CVE-2025-15556). Then in 2026 the config.xml and shortcuts.xml files turned out to be a route to arbitrary code execution (CVE-2026-48778, CVE-2026-48800).

The best-known case did not start in the editor’s code. Attackers compromised the hosting provider and redirected update traffic for selected users from June 2025, and CISA added CVE-2025-15556 to its Known Exploited Vulnerabilities catalog on February 12, 2026.

Notepad++ 8.9.8.1, released September 24, 2026, comes after the fixes for all of it.

Which Notepad++ vulnerabilities have been disclosed since 2025?

From mid-2025 on, two incidents stand out. One was an installer flaw that hands out SYSTEM rights. The other was a hijacked update channel that delivered malware to selected users.

The 2026 flaws are smaller, and most of them come down to how Notepad++ reads and acts on its own files.

The table lists the main flaws with a CVE ID and a published fix through 8.9.6.1, as of October 2026, when the Notepad++ site names 8.9.8.1 as the current release. Later fixes are covered in the version section below.

CVE-2026-6539 shipped in the same patch as CVE-2026-3008. Public write-ups describe it only as a related format string flaw in the same Find in Files code path, so it stays out of the table.

The failure points differ a lot between these. The installer searched the wrong folder for a system binary (CVE-2025-49144). The updater trusted downloads it never verified (CVE-2025-15556). In the editor itself, the 2026 CVEs with published detail all involve how it handled configuration and language files.

CVE-2025-15556 carries two scores. VulnCheck, the CNA, rates it 7.7 on CVSS 4.0, while NVD scores it 7.5 on CVSS 3.1 (NVD record, 2026).

How the Notepad++ installer flaw gives an attacker SYSTEM access

The v8.8.1 installer called regsvr32 without a full path, so Windows looked in the installer’s own folder before the system directory.

Anyone who gets a malicious regsvr32.exe next to the installer runs code as NT AUTHORITY\SYSTEM the moment the user launches setup. That is CVE-2025-49144, a local privilege escalation through binary planting.

In practice, social engineering or clickjacking puts the real installer and a malicious executable into the same folder, usually Downloads. The user runs the installer. The planted file then executes with SYSTEM privileges.

The GitHub Security Advisory (GHSA-9vx8-v79m-6m24, published June 21, 2025) scores the flaw 7.3 on CVSS 3.1 and files it under CWE-427, uncontrolled search path element. It also tags CWE-276, incorrect default permissions, and CWE-272, least privilege violation.

The reporters demonstrated a working proof of concept, a reverse shell running with SYSTEM privileges.

Notepad++ 8.8.2 fixes it by calling regsvr32 from the system directory path instead of relying on the search order.

The exploit has limits, though. The attacker has to get a file into the installer’s folder, so a clean download directory breaks the chain. The user also has to run the installer, which is what the user-interaction flag in the CVSS vector reflects. And because only low privileges are required, the attacker needs a local foothold or a convincing lure to begin with.

The advisory’s reference list includes Dell’s 2024 SupportAssist installer bulletin (DSA-2024-312), a related installer privilege escalation case.

What happened in the Notepad++ update hijack?

Attackers who had compromised Notepad++’s hosting provider redirected update requests from selected users to servers they controlled, starting in June 2025.

CVE-2025-15556 covers the other half of the story. WinGUp, the Notepad++ updater, did not verify what it downloaded.

Timeline of the compromise

The sources disagree on the end date. The security expert’s analysis puts it at November 10, 2025, while the provider’s logs show attacker access to internal credentials until December 2.

Kaspersky’s telemetry fits the earlier date. Malicious updates ran from late July to October 2025, with none seen since November.

Don Ho settled on June through December 2, 2025 as the overall window, the wider of the two readings.

Is it a flaw in Notepad++ code?

Don Ho’s February 2 post places the compromise at the hosting provider, not in Notepad++ code, and Orca Security’s write-up agrees, listing no CWE for the incident.

The CVE record tells it a little differently. It describes a real weakness in WinGUp, which did not cryptographically verify update metadata or installers before 8.8.9, and NVD files that under CWE-494, download of code without integrity check.

Both readings are right. The hosting breach opened the door, and missing verification let the redirected download run.

The 8.8.9 release note from December 9, 2025 already names the updater weakness. CISA added CVE-2025-15556 to its Known Exploited Vulnerabilities catalog on February 12, 2026, and NVD’s change history carries CISA’s tag marking exploitation as active.

Who was behind it and who was targeted

Kaspersky’s telemetry shows the attackers went after about a dozen machines, not the editor’s whole user base.

• Individuals in Vietnam, El Salvador and Australia
• A government organization in the Philippines
• A financial organization in El Salvador
• An IT service provider in Vietnam

Between July and October 2025 the attackers rotated infection chains about once a month, delivering Cobalt Strike Beacon and the custom Chrysalis backdoor that Rapid7 documented.

Notepad++ says multiple researchers assess a Chinese state-sponsored group. Tenable names it Lotus Blossom (also tracked as Billbug, Raspberry Typhoon and Thrip), while The Hacker News calls it Lotus Panda.

Tenable’s FAQ describes the campaign as targeted espionage rather than ransomware or extortion.

What the 8.8.9, 8.9.1 and 8.9.2 fixes changed

Each release tightened the update path a bit more.

Version 8.8.9 (December 9, 2025) made WinGUp check the signature and certificate of the downloaded installer, and it aborts the update if either check fails. In 8.9.1 the XML returned by the update server became signed with XMLDSig (Tenable FAQ).

Then 8.9.2 enforced verification of both. Don Ho calls the design double lock, and plugin management now runs only for programs signed with WinGUp’s certificate (The Hacker News).

Binaries have carried a GlobalSign certificate since 8.8.7, so the old Notepad++ root certificate is no longer needed. The project recommends removing it from machines that installed it.

Notepad++ config.xml and shortcuts.xml flaws fixed in 8.9.6.1

Notepad++ 8.9.6.1, released May 26, 2026, fixed two arbitrary code execution bugs and a crash (Notepad++ release note). CVE-2026-48778 is code execution through config.xml, CVE-2026-48800 does the same through shortcuts.xml, and CVE-2026-48770 is a crash triggered by a malformed COPYDATASTRUCT message.

The GitHub advisory for CVE-2026-48778 says the commandLineInterpreter entry in config.xml is read without validation and passed to ShellExecute() when a user picks File, Open Containing Folder, cmd. Whoever controls that value can swap in any program.

The advisory describes several ways to get a poisoned config onto a machine. Someone with the user’s privileges can write straight to %APPDATA%\Notepad++\config.xml. A malicious .lnk shortcut can use the -settingsDir= argument to point Notepad++ at an attacker-controlled settings folder. A tampered config can also arrive through the cloud path support in Parameters.cpp, and archive extraction into AppData through social engineering works as well.

The fix launches external programs by absolute path and shows a confirmation dialog when the path sits outside a trusted directory (8.9.6.1 release thread, Notepad++ community forum). For config.xml, the commandLineInterpreter setting was removed and a PowerShell option was added instead. Versions 8.9.6 and earlier are affected.

The shortcuts.xml fix needed follow-ups. Version 8.9.6.2 (May 31, 2026) closed a bypass of the CVE-2026-48800 fix (CVE-2026-52884), and 8.9.6.4 (June 4, 2026) fixed a TOCTOU flaw in the HMAC check introduced in 8.9.6.2 (CVE-2026-52885).

Some outlets call the two code execution flaws critical, but the GitHub advisories rate each one High at 7.8 on CVSS 3.1. The rating is also disputed on the forum. One forum user argues the config.xml CVE is not a security vulnerability, and the direct-write route does need same-privilege access.

The shortcut and cloud-sync routes matter more, since neither needs the attacker to already hold write access on the machine.

Smaller 2026 flaws patched in 8.9.2 and 8.9.4

CVE-2026-25926 (fixed in 8.9.2) and CVE-2026-3008 (fixed in 8.9.4) are narrower than the update hijack. One needs a planted explorer.exe, the other a swapped language file.

CVE-2026-25926 is an unsafe search path (CWE-426). Notepad++ launched Windows Explorer without an absolute executable path, so a malicious explorer.exe runs if the attacker controls the process working directory.

Under certain conditions that leads to code execution with the rights of the running Notepad++ process (NVD record, February 2026). The 7.3 in the CVE table above is the CVSS 3.1 score published by the GitHub CNA, since NVD has not provided its own assessment.

CVE-2026-3008 is a format string flaw in Find in Files. The 8.9.4 release notes describe a crash when the find-result-hits entry in nativeLang.xml contains %s, and Singapore’s Cyber Security Agency (April 27, 2026) lists 8.9.3 as the affected version, with a crash or leaked memory address as the result.

Exploitation needs the victim to replace nativeLang.xml with a malicious copy. SQ Magazine’s advice to skip unverified language packs and XML files is the practical defense.

The score is where sources split. The UAE Cyber Security Council’s April 28 advisory rates the flaw critical, with a CVSS 4.0 score of 10. That figure appears to come from a CVSS 4.0 vector the Singapore agency first published on April 27 and replaced the same day, according to NVD’s change history. The current CVE record carries a CVSS 3.1 score of 6.6, and NVD has not provided its own assessment.

A 10 sits awkwardly next to a crash-or-leak impact and a file-swap precondition, which is why the table above shows the 6.6 and flags it as disputed.

CVE-2026-6539 rides on the same fix. The 8.9.4 release notes list both IDs on a single Find in Files crash entry, and trackers describe CVE-2026-6539 only as a related format string flaw in that code path.

Put these next to the installer and config.xml flaws and a pattern shows up. Three separate CVEs trace back to starting a program without an absolute path: regsvr32 in the installer, explorer.exe in CVE-2026-25926, and the launch target in config.xml.

The installer fix and the 8.9.6.1 fix both moved to absolute paths.

Which Notepad++ version is safe to run?

Run the current release, 8.9.8.1 as of October 2026, rather than the lowest version that closes one flaw.

The CVE table above stops at 8.9.6.1, and Notepad++ kept shipping security fixes after it. Here is how they landed, version by version.

• 8.9.2 enforces signature and certificate checks on updates, which makes it the floor for the update hijack
• 8.9.6.1 closes the config.xml flaw and the malformed-message crash
• 8.9.6.2 and 8.9.6.4 (May 31 and June 4, 2026) close a bypass of the shortcuts.xml fix and a TOCTOU flaw in its HMAC check
• 8.9.7 (July 14, 2026) carries 5 vulnerability fixes, including the WinGUp Zip Slip flaw CVE-2026-57233
• 8.9.8 (August 23, 2026) has 14 vulnerability entries, among them an Authenticode verification bypass (CVE-2026-85995) and a WinGUp TOCTOU (time-of-check to time-of-use) issue
• 8.9.8.1 (September 24, 2026) adds 5 more entries, listed without CVE IDs on the release page

The 8.9.7, 8.9.8 and 8.9.8.1 releases carry 24 vulnerability entries in about ten weeks, per the Notepad++ release notes. Mid-July coverage counted two of the 8.9.7 flaws as awaiting CVE IDs, but the release page now links IDs for all five.

A floor is a trap for another reason. The shortcuts.xml file drew fixes in five consecutive security releases: arbitrary code execution in 8.9.6.1, a bypass of that fix in 8.9.6.2, an HMAC TOCTOU flaw in 8.9.6.4, then HMAC bypass fixes in 8.9.7 and 8.9.8.

Sources also disagree on the floor for the update hijack. Orca Security recommends 8.9.1 (and lists 8.8.9 onward as fixed), The Hacker News names 8.9.2, and Tenable lists 8.9.1 as fixed while noting that enforcement was still expected in 8.9.2.

8.9.1 signed the update manifest and 8.9.2 made verification mandatory, so 8.9.2 is the lowest version worth calling fixed.

How to check an install and update it safely

Check the machine if its updater ran between June and early December 2025, then reinstall by hand from the official domain.

A copy that never auto-updated in that window can skip straight to the update steps.

Check for signs of the update hijack

Notepad++’s incident response team went through roughly 400 GB of server logs and found signs of intrusion but no concrete indicators such as binary hashes, domains or IP addresses (Don Ho, February 2, 2026).

Researchers filled the gap from the endpoint side, and what they found gives you something concrete to search for.

• gup.exe connecting to anything other than notepad-plus-plus.org, github.com or release-assets.githubusercontent.com (Orca Security)
• update.exe or AutoUpdater.exe in %TEMP%, a hidden Bluetooth folder in %AppData% holding BluetoothService.exe and log.dll, or a USOShared folder under C:\ProgramData containing conf.c (Orca Security, Rapid7)
• Output from whoami, tasklist, systeminfo and netstat uploaded to temp.sh (Kaspersky)
• The mutex Global\Jdhfv\_1.0.1, linked to the Chrysalis backdoor (Rapid7, Unit 42)

The former hosting provider’s list, published on the Notepad++ site on February 5, 2026, covers the server side only: 11 IP addresses, 2 user-agent strings and 4 malicious PHP file hashes. The provider itself warns that the IPs are not definitive indicators of end-user compromise.

Rapid7 puts the hunting window at June through November 2025, and Unit 42 notes that most activity likely predates December 2, so check how far back your logs go.

A clean result is not proof. Kaspersky says it would not be surprised to see more infection chains than the ones it documented.

Update Notepad++ manually

A manual install from the official domain sidesteps the update channel that was hijacked.

1. Open About Notepad++ from the ? menu and note the version
2. Type notepad-plus-plus.org into the browser yourself, since the download page carries a notice asking visitors to report malicious ads
3. Download the installer for your architecture (x64, x86 or ARM64)
4. Check the SHA-256 digest or GPG signature published on the download page
5. Run the installer, and untick the auto-updater option if you do not want it
6. Reopen About Notepad++ and confirm the version matches

For managed fleets, Notepad++’s February 5, 2026 guidance for enterprise IT shows an MSI install with the updater switched off:

msiexec /i npp.8.9.1.Installer.x64.msi NOUPDATER=1

Turning WinGUp off on managed machines is a defensible call. Notepad++ shipped more WinGUp fixes after the double lock design, a Zip Slip flaw in 8.9.7 and a TOCTOU issue in 8.9.8.

On unmanaged home machines, the bigger risk is an old install nobody updates, so keeping the updater on a current release is a fair trade.

Is Notepad++ still safe to use?

Yes on a current release, though administrators and developers with privileged access should treat the update hijack as a possible exposure until they have checked.

Notepad++’s February 5, 2026 clarification says the application itself was not hacked and that most users were never affected, because attackers picked victims by strategic value.

Kaspersky’s victim list came from its own telemetry, so it undercounts. Unit 42 (February 2026) reports activity in more regions and sectors: South America, the US, Europe and Southeast Asia, across cloud hosting, energy, financial, government, manufacturing and software development.

Unit 42 explains the pull. Administrators and DevOps staff use Notepad++ on jump boxes, so compromising it reaches privileged sessions. Rapid7 told CyberScoop it saw no evidence of bulk data exfiltration and read the aim as strategic intelligence collection.

Both pictures fit. Targeting was selective, so the odds are low for a home user and real for anyone holding privileged access to other people’s systems.

Plenty of setups sit outside the risk, or at least outside anything proven.

Machines that never ran WinGUp between June and early December 2025, or were updated by hand from the official domain, are clear of the update hijack. The config-file flaws need settings that sync to a cloud path or shortcuts from strangers, so local settings and unopened shortcuts from unknown senders keep you out of it.

The five 8.9.7 flaws had no real-world exploitation reported in July 2026 coverage (VPNCentral).

CVE-2025-56383 is a different story. Notepad++ rejects it as a non-issue, since plugins sit in the protected Program Files directory and an attacker with the administrator rights needed to modify them could replace any system file (release note, October 7, 2025).

The risk stays real on old installs with the updater left on. It stays real on profiles synced to shared or cloud folders, and on privileged workstations nobody has hunted yet.

Notepad++ Vulnerability FAQ

What is WinGUp in Notepad++?

The updater bundled with Notepad++ goes by WinGUp, short for Windows Generic Updater. It runs as gup.exe, asks notepad-plus-plus.org for a download URL, then launches the installer it receives.

Trust in that server reply is what the update hijack abused.

What does a CVSS score of 7.3 mean?

A 7.3 lands in the High band. FIRST’s CVSS v3.1 scale puts High at 7.0 to 8.9 and Critical at 9.0 to 10.0.

The score measures technical severity, not attacker interest, which is why a local flaw needing user interaction, like CVE-2025-49144, still reaches 7.3.

How can IT teams scan for vulnerable Notepad++ versions?

Tenable published Nessus plugin 297583, an informational check that flags Notepad++ installs older than 8.9.1 by their self-reported version.

For hijack hunting, Unit 42 shared XQL queries covering gup.exe behavior, Kaspersky released a SIEM correlation rule package, and Rapid7 deployed a detection for suspicious child processes of gup.exe.

Does the CISA Known Exploited Vulnerabilities listing apply to private companies?

No, not as a mandate. CISA added CVE-2025-15556 on February 12, 2026 with a due date of March 5, 2026, which binds US federal civilian agencies under BOD 22-01.

For everyone else, the listing signals that exploitation was observed and the patch deserves priority.

Why do some Notepad++ security fixes have no CVE ID?

CVE assignment can trail the patch. The 8.9.8.1 release page links five fixes that still await CVE IDs, and two 8.9.7 fixes were in the same state in July before IDs appeared.

Track the GitHub Security Advisory identifier until a CVE arrives.

Who reported the Notepad++ installer flaw?

The GitHub advisory for CVE-2025-49144 credits three reporters: Shashi Raj (EmperialX), Yatharth Tyagi (Heated-Yeti) and Kunal Choudhary (kunal0x00).

Notepad++ maintainer Don Ho published the advisory.

Why did some Notepad++ releases trigger antivirus warnings?

Version 8.8.2 shipped without a code-signing certificate, and versions 8.8.3 and 8.8.6 were signed with a self-signed certificate. Notepad++ told users that antivirus complaints on those builds were likely false positives to report to the antivirus company.

Since 8.8.7, a GlobalSign certificate signs the binaries.

Staying Ahead of the Next Notepad++ Patch

Staying ahead of a Notepad++ vulnerability means patching on release day, not when an incident write-up appears.

Notepad++ shipped its first updater verification in 8.8.9, 55 days before the February 2, 2026 disclosure of the full update hijack.

On privileged machines, order matters. Export gup.exe and process logs before retention expires, update to the current release, and only then set an updater policy for WinGUp.

Logs age out, while a patch can wait a day.

Switching WinGUp off removes the hijack channel but hands the patching job to your team, one deployment cycle per release.

The advice was verified on October 14, 2026 against 8.9.8.1. A newer release, or a Known Exploited Vulnerabilities listing for any later Notepad++ CVE, would change it.

• Author
• Recent Posts

Bogdan Sandu

Bogdan Sandu is a front-end developer at TMS Outsource with 8+ years of experience in web technologies. He writes about developer tools, software platforms, and web workflows based on daily hands-on use.

Latest posts by Bogdan Sandu (see all)

• Notepad++ Vulnerability History and How to Stay Safe - October 27, 2026
• Application Performance Monitoring Beyond the Code: Why Infrastructure Matters - October 26, 2026
• How to Share GitHub Repository Access With Collaborators - October 25, 2026