CVE-2026-85995 in Notepad++
Summary
by MITRE • 09/22/2026
Notepad++ is a free and open-source source code editor. From 8.9.7 until 8.9.8, the Notepad++ updater and signature verification path can accept a modified GUP.exe file whose embedded certificate metadata remains present even though its Authenticode digest is invalid. An attacker who can replace or plant the updater-related file can cause Notepad++ to launch attacker-modified code when a user triggers the updater path, but the issue does not provide remote code execution by itself. This issue is fixed in version 8.9.8.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
Notepad++ is a widely utilized free and open-source source code editor that supports multiple programming languages through plugins and syntax highlighting features. The software includes an automatic update mechanism designed to ensure users remain on the latest stable release with security patches and feature improvements. This updater component, typically executed via a helper executable such as GUP.exe, relies on digital signatures to verify the integrity and authenticity of updates before installation. In versions ranging from 8.9.7 through 8.9.8, a critical flaw exists in how this signature verification process handles embedded certificate metadata versus the actual Authenticode digest validation logic.
The technical vulnerability stems from an incomplete or flawed implementation within the updater's code path that checks for valid digital signatures. Specifically, when processing update files, Notepad++ verifies the presence of embedded certificate metadata but fails to strictly enforce the validity of the underlying Authenticode cryptographic hash against this metadata. This discrepancy allows a modified GUP.exe file to pass verification if it retains the original certificate structure, even though its actual code content has been altered and does not match the expected digital signature digest. Consequently, the application trusts the binary as legitimate despite it being tampered with by an attacker who can replace or plant files in the relevant directory.
From a threat modeling perspective, this vulnerability is classified under CWE-347 which pertains to Improper Verification of Cryptographic Signature. The attack vector requires local access or physical proximity because an adversary must have the ability to modify or inject files into Notepad++'s installation directory or update path. This aligns with ATT&CK technique T1059, Command and Scripting Interpreter, as it enables the execution of arbitrary code through a trusted application process. However, it is crucial to note that this flaw does not constitute remote code execution on its own since network-based exploitation is not feasible without prior local access or social engineering leading to file placement.
The operational impact of this vulnerability allows an attacker with sufficient privileges to escalate trust within the Notepad++ ecosystem. By replacing the updater executable, any subsequent trigger for the update mechanism will launch the malicious binary instead of the legitimate one. This can lead to arbitrary code execution under the context of the user running Notepad++, potentially resulting in data exfiltration, persistence mechanisms being established, or further lateral movement within a compromised environment. The severity is heightened by the fact that users often run editors with elevated privileges during development tasks, increasing the potential blast radius if such an attack were successfully executed.
Mitigation strategies primarily involve upgrading to version 8.9.8 where this verification logic has been corrected to ensure strict adherence between certificate metadata and Authenticode digests. Until patching is possible, administrators should restrict write permissions on Notepad++ installation directories to prevent unauthorized file modifications. Additionally, implementing application control policies that validate executable signatures at the operating system level can provide an additional layer of defense against executing tampered binaries regardless of how they were invoked by parent processes like the updater utility.