CVE-2026-25926
📋 TL;DR
Notepad++ versions before 8.9.2 have an unsafe search path vulnerability when launching Windows Explorer. This could allow an attacker to execute malicious code by placing a fake explorer.exe in a controlled directory, potentially leading to arbitrary code execution with the same privileges as the Notepad++ user.
💻 Affected Systems
- Notepad++
📦 What is this software?
Notepad\+\+ by Notepad Plus Plus
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via arbitrary code execution with the privileges of the Notepad++ user, potentially leading to lateral movement or persistence.
Likely Case
Local privilege escalation or execution of malicious payloads if an attacker can control the working directory.
If Mitigated
Limited impact due to user privilege restrictions and lack of attacker-controlled directories.
🎯 Exploit Status
Requires local access and ability to control the process working directory or place malicious explorer.exe in a directory that will be searched before the legitimate Windows directory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.9.2
Vendor Advisory: https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-rjvm-fcxw-2jxq
Restart Required: Yes
Instructions:
1. Download Notepad++ 8.9.2 or later from https://notepad-plus-plus.org/downloads/ 2. Run the installer 3. Restart Notepad++ if already running
🔧 Temporary Workarounds
Avoid launching Windows Explorer from Notepad++
windowsDo not use the 'Open Containing Folder' or similar features that launch Windows Explorer from Notepad++
Restrict directory permissions
windowsEnsure users cannot write to directories that would be searched before the legitimate Windows directory
🧯 If You Can't Patch
- Restrict user permissions to prevent writing to directories in the system PATH
- Implement application whitelisting to block execution of unauthorized explorer.exe files
🔍 How to Verify
Check if Vulnerable:
Check Notepad++ version in Help > About Notepad++. If version is below 8.9.2, the system is vulnerable.Check Version:
notepad++ --version or check in Help > About Notepad++Verify Fix Applied:
After updating, verify version is 8.9.2 or higher in Help > About Notepad++.📡 Detection & Monitoring
Log Indicators:
- Process creation events for explorer.exe from unusual directories
- Notepad++ process spawning unexpected child processes
Network Indicators:
- Unusual outbound connections following Notepad++ execution
SIEM Query:
Process Creation where Parent Process Name contains 'notepad++' and Process Name contains 'explorer.exe' and Process Path not contains 'C:\Windows'