CVE-2026-25926: 
Notepad++ vulnerability analysis and mitigation

CVE-2026-25926 is an Untrusted Search Path (CWE-426) vulnerability in Notepad++ that allows a local attacker to execute arbitrary code by placing a malicious explorer.exe in a directory resolved before the legitimate Windows system binary. It affects all Notepad++ versions up to and including 8.9.1, and was patched in version 8.9.2, released on February 16, 2026. The vulnerability was published on February 19, 2026, and carries a CVSS v3.1 base score of 7.3 (High) (GitHub Advisory, Red Hat CVE).

The root cause is that Notepad++ constructs a command string invoking explorer without specifying its absolute path (e.g., explorer /select,"<path>" or explorer "<path>"), relying on Windows' standard executable search order, which may include the current working directory before trusted system locations such as System32 (GitHub Advisory). If an attacker can control the process working directory and place a malicious explorer.exe there, it will be executed instead of the legitimate Windows Explorer when Notepad++ attempts to open a file or folder. This maps to MITRE ATT&CK technique T1574.007 (Path Interception by PATH Environment Variable) and CAPEC-38 (Leveraging/Manipulating Configuration File Search Paths). A video Proof of Concept was included in the security advisory, demonstrating arbitrary code execution (launching calc.exe) on Notepad++ 8.9.1 (GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the Notepad++ process, potentially leading to full system compromise depending on the user's privilege level. All three security pillars are affected at a high level — confidentiality, integrity, and availability — as the attacker-controlled binary can read, modify, or destroy data and system resources. An adversary could leverage this for persistence, lateral movement, or delivery of additional malware payloads, as demonstrated in the context of poisoned update mechanisms (GitHub Advisory, The Hacker News).

A video PoC was published alongside the security advisory by reporter MarioRL0, demonstrating the vulnerability in Notepad++ 8.9.1 (GitHub Advisory). Media reporting linked the vulnerability to real-world exploitation scenarios involving China-linked threat actors poisoning Notepad++ update mechanisms to deliver targeted malware (The Hacker News, Undercode News). The EPSS score is 0.011% (0.000110), indicating low automated exploitation probability at this time. The vulnerability is not currently listed in the CISA KEV catalog. Detection plugins are available from Qualys (ID: 386594) and Nessus (ID: 299664) (Feedly).

1. Reconnaissance: Identify systems running Notepad++ versions 8.9.1 or earlier, using asset inventory tools or vulnerability scanners (Qualys, Nessus plugin 299664).
2. Gain initial access or working directory control: Obtain low-privilege local access to the target system, or leverage a supply chain/update mechanism compromise to control the directory from which Notepad++ is launched.
3. Place malicious binary: Drop a crafted explorer.exe into a directory that will be resolved before C:\Windows\System32\ in the Windows executable search order — for example, the current working directory of the Notepad++ process or a directory earlier in the PATH.
4. Trigger the vulnerable code path: Cause the victim user to use Notepad++'s "Open Containing Folder" or similar file browser feature, which internally executes explorer without an absolute path.
5. Achieve code execution: The malicious explorer.exe is executed in place of the legitimate Windows Explorer, running arbitrary attacker-controlled code with the privileges of the Notepad++ process. The PoC demonstrates this by additionally launching calc.exe while mimicking normal Explorer behavior to avoid detection (GitHub Advisory).

• File System: Presence of an unexpected explorer.exe in non-standard directories (e.g., the Notepad++ installation directory, user profile directories, or any directory in the PATH other than C:\Windows\System32\); file hash mismatch for explorer.exe compared to the known-good Windows binary.
• Process: explorer.exe spawned as a child process of notepad++.exe from a non-standard path (e.g., not C:\Windows\explorer.exe); unexpected child processes (e.g., calc.exe, cmd.exe, powershell.exe) spawned from a non-standard explorer.exe.
• Logs: Windows Event Logs (Event ID 4688 or Sysmon Event ID 1) showing process creation of explorer.exe with an image path outside C:\Windows\; audit logs showing Notepad++ invoking explorer from an unusual working directory.
• Network: Unexpected outbound connections from a process masquerading as explorer.exe originating from a non-standard path (GitHub Advisory).

Upgrade Notepad++ to version 8.9.2 or later, which patches the issue by specifying the absolute path to explorer.exe when launching Windows Explorer (GitHub Release, GitHub Advisory). As a workaround prior to patching, restrict write access to directories in the PATH and the Notepad++ working directory to prevent placement of malicious binaries. Organizations should also audit their software update and distribution pipelines for signs of supply chain compromise, particularly given reported threat actor activity targeting Notepad++ update mechanisms (The Hacker News).

The Hacker News and Security Affairs covered the vulnerability with emphasis on its exploitation in the context of a hijacked Notepad++ update mechanism attributed to China-linked threat actors, framing it as a supply chain security concern (The Hacker News, Security Affairs). Heise.de covered it as a "code smuggling vulnerability" requiring an emergency security update (Heise). Community reaction on social platforms was notable given Notepad++'s widespread use among developers and IT professionals, with the patch receiving positive engagement on the GitHub release page (62 reactions). The vulnerability was also featured in multiple weekly threat landscape digests, reflecting broad industry awareness (Hawk-Eye Digest).