CVE-2026-25926highCWE-426

CVE-2026-25926: fallo de gravedad alta en notepad-plus-plus

Notepad++ has an Untrusted Search Path

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear notepad-plus-plus

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.3epss 0.3%
Notepad++ is a free and open-source source code editor. An Unsafe Search Path vulnerability (CWE-426) exists in versions prior to 8.9.2 when launching Windows Explorer without an absolute executable path. This may allow execution of a malicious explorer.exe if an attacker can control the process working directory. Under certain conditions, this could lead to arbitrary code execution in the context of the running application. Version 8.9.2 patches the issue.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Productos afectados
notepad-plus-plus · notepad-plus-plus
CVEs relacionadas — notepad-plus-plus

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-15556HIGHNotepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity VerificationEPSS 1.7%KEVCVE-2022-32168HIGHnotepad-plus-plus - DLL HijackingEPSS 0.8%CVE-2025-49144HIGHNotepad++ Privilege Escalation in Installer via Uncontrolled Executable Search PathEPSS 0.7%CVE-2026-48778HIGHNotepad++: Arbitrary Code Execution via config.xml commandLineInterpreterEPSS 0.6%CVE-2023-40031HIGHNotepad++ vulnerable to heap buffer write overflow in Utf8_16_Read::convertEPSS 0.5%CVE-2026-57233HIGHNotepad++: Path Traversal (Zip Slip) in WinGup Plugin ExtractionEPSS 0.5%