CVE-2026-25926

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25926", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-09T16:22:17.785Z", "datePublished": "2026-02-18T23:07:36.383Z", "dateUpdated": "2026-02-19T17:45:27.028Z"}, "containers": {"cna": {"title": "Notepad++ has an Untrusted Search Path", "problemTypes": [{"descriptions": [{"cweId": "CWE-426", "lang": "en", "description": "CWE-426: Untrusted Search Path", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-rjvm-fcxw-2jxq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-rjvm-fcxw-2jxq"}, {"name": "https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.2"}, {"name": "https://notepad-plus-plus.org/news/v892-released", "tags": ["x_refsource_MISC"], "url": "https://notepad-plus-plus.org/news/v892-released"}], "affected": [{"vendor": "notepad-plus-plus", "product": "notepad-plus-plus", "versions": [{"version": "< 8.9.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-18T23:07:36.383Z"}, "descriptions": [{"lang": "en", "value": "Notepad++ is a free and open-source source code editor. An Unsafe Search Path vulnerability (CWE-426) exists in versions prior to 8.9.2 when launching Windows Explorer without an absolute executable path. This may allow execution of a malicious explorer.exe if an attacker can control the process working directory. Under certain conditions, this could lead to arbitrary code execution in the context of the running application. Version 8.9.2 patches the issue."}], "source": {"advisory": "GHSA-rjvm-fcxw-2jxq", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-19T17:07:31.919150Z", "id": "CVE-2026-25926", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T17:45:27.028Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25926", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-19T17:07:31.919150Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T17:07:33.898Z"}}], "cna": {"title": "Notepad++ has an Untrusted Search Path", "source": {"advisory": "GHSA-rjvm-fcxw-2jxq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "notepad-plus-plus", "product": "notepad-plus-plus", "versions": [{"status": "affected", "version": "< 8.9.2"}]}], "references": [{"url": "https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-rjvm-fcxw-2jxq", "name": "https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-rjvm-fcxw-2jxq", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.2", "name": "https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.2", "tags": ["x_refsource_MISC"]}, {"url": "https://notepad-plus-plus.org/news/v892-released", "name": "https://notepad-plus-plus.org/news/v892-released", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Notepad++ is a free and open-source source code editor. An Unsafe Search Path vulnerability (CWE-426) exists in versions prior to 8.9.2 when launching Windows Explorer without an absolute executable path. This may allow execution of a malicious explorer.exe if an attacker can control the process working directory. Under certain conditions, this could lead to arbitrary code execution in the context of the running application. Version 8.9.2 patches the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-426", "description": "CWE-426: Untrusted Search Path"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-18T23:07:36.383Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25926", "state": "PUBLISHED", "dateUpdated": "2026-02-19T17:45:27.028Z", "dateReserved": "2026-02-09T16:22:17.785Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-18T23:07:36.383Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "notepad-plus-plus", "vendor": "notepad-plus-plus", "versions": [{"status": "affected", "version": "< 8.9.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:notepad-plus-plus:notepad\\+\\+:*:*:*:*:*:*:*:*", "matchCriteriaId": "372C203D-E0C9-48B7-8F39-E06FDFBBE7DE", "versionEndExcluding": "8.9.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Notepad++ is a free and open-source source code editor. An Unsafe Search Path vulnerability (CWE-426) exists in versions prior to 8.9.2 when launching Windows Explorer without an absolute executable path. This may allow execution of a malicious explorer.exe if an attacker can control the process working directory. Under certain conditions, this could lead to arbitrary code execution in the context of the running application. Version 8.9.2 patches the issue."}, {"lang": "es", "value": "Notepad++ es un editor de c\u00f3digo fuente gratuito y de c\u00f3digo abierto. Hay una vulnerabilidad de ruta de b\u00fasqueda insegura (CWE-426) en versiones anteriores a la 8.9.2 al iniciar el Explorador de Windows sin una ruta de ejecuci\u00f3n absoluta. Esto puede permitir la ejecuci\u00f3n de un explorer.exe malicioso si un atacante puede controlar el directorio de trabajo del proceso. Bajo ciertas condiciones, esto podr\u00eda llevar a la ejecuci\u00f3n de c\u00f3digo arbitrario en el contexto de la aplicaci\u00f3n en ejecuci\u00f3n. La versi\u00f3n 8.9.2 corrige el problema."}], "id": "CVE-2026-25926", "lastModified": "2026-06-17T10:25:26.373", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25926", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-19T17:07:31.919150Z", "version": "2.0.3"}}]}, "published": "2026-02-19T00:16:21.787", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.2"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-rjvm-fcxw-2jxq"}, {"source": "security-advisories@github.com", "tags": ["Press/Media Coverage"], "url": "https://notepad-plus-plus.org/news/v892-released"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-426"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.9.2)"}}], "enrichment": {"confidence": 83.0, "confidence_source": "matching", "scores": [{"score": 83.0, "source": "matching"}]}, "original": {"product": "notepad-plus-plus", "source": "cna", "vendor": "notepad-plus-plus"}, "product": "notepad++", "vendor": "notepad-plus-plus"}], "analysis": {"en": {"generated_at": "2026-04-17T18:21:40.165003+00:00", "value": {"mitigation_remediation": ["Upgrade to Notepad++ 8.9.2 or later to apply the fixed version that validates the executable path.", "If upgrading is not immediately possible, ensure that the directory from which Notepad++ runs does not contain untrusted executables and that the system\u2019s working directory is strictly controlled.", "Regularly verify that explorer.exe in the working environment is the legitimate Windows binary using digital signature checks, and monitor for unexpected changes."], "summary": {"action": "Apply Patch", "impact": "Arbitrary Code Execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Notepad++ for Windows released before version 8.9.2. All earlier editions are susceptible because they do not validate the path used to invoke explorer.exe.", "description_and_impact": "An unsafe search path flaw (CWE-426) exists in Notepad++ versions earlier than 8.9.2. When launching Windows Explorer without specifying an absolute executable path, the application may execute a malicious explorer.exe if an attacker can control the process working directory. This can result in arbitrary code execution within the context of the running Notepad++ process, jeopardizing the confidentiality and integrity of user data.", "risk_and_exploitability": "The CVSS score of 7.3 indicates a medium\u2011high risk, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The risk is not currently listed in the CISA KEV catalog. Likely attack conditions require the attacker to have local access or influence over the working directory used by Notepad++; once that is achieved, launching the editor can trigger execution of a malicious explorer.exe. The threat is most pronounced for users running older builds on shared or multi\u2011user systems where directory contents may be manipulated."}}}}, "created": "2026-02-19T10:08:00.479651+00:00", "updated": "2026-04-17T18:30:05.651508+00:00", "vendors": ["notepad-plus-plus", "notepad-plus-plus$PRODUCT$notepad++"]}