← Back

CVE-2026-25926

nvd nist
Published: Feb 19, 2026Modified: Feb 19, 2026

JSON object

Loading...
7.3
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Exploitability: 1.3 / Impact: 5.9
Source: security-advisories@github.com (Secondary)

Description

Notepad++ is a free and open-source source code editor. An Unsafe Search Path vulnerability (CWE-426) exists in versions prior to 8.9.2 when launching Windows Explorer without an absolute executable path. This may allow execution of a malicious explorer.exe if an attacker can control the process working directory. Under certain conditions, this could lead to arbitrary code execution in the context of the running application. Version 8.9.2 patches the issue.

Affected (1)

Notepad Plus Plus
1 product
Notepad++
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Notepad++
Before 8.9.2

Related CWEs

CWE-426
Untrusted Search Path
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

References (3)

Source: security-advisories@github.com
ProductRelease Notes
Source: security-advisories@github.com
ExploitVendor Advisory
Source: security-advisories@github.com
Press/Media Coverage

Timeline

No history available yet.