notepad-plus-plus Notepad++ up to 8.9.1 explorer.exe untrusted search path

Summaryinfo

A vulnerability marked as problematic has been reported in notepad-plus-plus Notepad++ up to 8.9.1. This vulnerability affects unknown code of the file explorer.exe. The manipulation leads to untrusted search path. This vulnerability is traded as CVE-2026-25926. An attack has to be approached locally. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in notepad-plus-plus Notepad++ up to 8.9.1. It has been rated as critical. This issue affects an unknown code of the file explorer.exe. The manipulation with an unknown input leads to a untrusted search path vulnerability. Using CWE to declare the problem leads to CWE-426. The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Notepad++ is a free and open-source source code editor. An Unsafe Search Path vulnerability (CWE-426) exists in versions prior to 8.9.2 when launching Windows Explorer without an absolute executable path. This may allow execution of a malicious explorer.exe if an attacker can control the process working directory. Under certain conditions, this could lead to arbitrary code execution in the context of the running application. Version 8.9.2 patches the issue.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-25926 since 02/09/2026. The exploitation is known to be difficult. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1574 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 299664 (Notepad++ < 8.9.2 Unsafe Search Path (GHSA-rjvm-fcxw-2jxq)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 8.9.2 eliminates this vulnerability. The upgrade is hosted for download at github.com.

The vulnerability is also documented in the vulnerability database at Tenable (299664). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Document Reader Software

Vendor

• notepad-plus-plus

Name

• Notepad++

Version

• 8.9.0
• 8.9.1

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion