CVE-2026-85995: 
Notepad++ vulnerability analysis and mitigation

CVE-2026-85995 is an Authenticode verification bypass vulnerability in Notepad++ that allows a locally positioned attacker to cause the application to execute a tampered updater binary. Affecting Notepad++ version 8.9.7, the flaw exists in the updater and signature verification path, which checks for the presence of certificate metadata but does not fully validate the Authenticode file digest. The vulnerability was disclosed on August 24, 2026, via a GitHub Security Advisory, and fixed in version 8.9.8. It carries a CVSS v3.1 base score of 7.3 (High) (GitHub Advisory).

The root cause is classified as CWE-347 (Improper Verification of Cryptographic Signature). Notepad++'s SecurityGuard::verifySignedBinary() function in verifySignedfile.cpp called WinVerifyTrust but had _doCheckChainOfTrust set to false and conditionally skipped logging and returning false on trust failure, effectively allowing files with embedded certificate metadata — but an invalid Authenticode digest — to pass verification. An attacker with local write access to the Notepad++ updater directory can replace GUP.exe with a modified binary that retains the original certificate but has tampered content; when a user triggers the update path from the GUI, Notepad++ launches the attacker-controlled binary. The same weak verification was also observed to affect the Plugins Admin path (nppPluginList.dll), where a digest-invalid catalog was accepted and attacker-modified catalog content was displayed (GitHub Advisory, Fix Commit).

Successful exploitation allows an attacker to execute arbitrary code in the context of the user running Notepad++, with high confidentiality, integrity, and availability impact on the affected system. Because the attack requires local access to plant or replace the updater binary and user interaction to trigger the update path, the scope is limited to the local machine and does not constitute remote code execution on its own. However, in environments where the Notepad++ installation directory is writable by lower-privileged users or shared across systems, this could serve as a privilege escalation or persistence mechanism (GitHub Advisory).

No in-the-wild exploitation has been reported, and no exploit kits or weaponized code are publicly known beyond the marker-only proof-of-concept described in the security advisory. The EPSS score is approximately 0.00124, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and NVD's SSVC assessment classifies exploitation as "none" and automation as "no" (GitHub Advisory).

1. Reconnaissance: Identify systems running Notepad++ 8.9.7 on Windows and confirm write access to the Notepad++ installation directory (e.g., C:\Program Files\Notepad++\updater\ or the portable installation path).
2. Obtain original GUP.exe: Extract or copy the legitimate GUP.exe updater binary from the Notepad++ 8.9.7 installation to preserve its embedded Authenticode certificate metadata.
3. Modify the binary: Alter the binary content (e.g., inject a payload or replace executable code) while preserving the embedded certificate structure, ensuring the certificate metadata remains intact but the Authenticode digest becomes invalid.
4. Verify bypass condition: Use a tool such as sigcheck (Sysinternals) or PowerShell's Get-AuthenticodeSignature to confirm the modified binary fails Authenticode digest validation while still containing the original certificate.
5. Plant the modified binary: Replace the legitimate GUP.exe in the Notepad++ updater path with the modified binary.
6. Trigger execution: Wait for or socially engineer the target user to trigger the Notepad++ updater path via the GUI (e.g., ? > Update Notepad++). Notepad++ accepts and launches the modified binary, executing the attacker's payload in the user's security context (GitHub Advisory).

• File System: Presence of a GUP.exe in the Notepad++ updater directory that fails Get-AuthenticodeSignature digest validation (status HashMismatch) but still contains a valid-looking certificate; unexpected modification timestamps on GUP.exe or nppPluginList.dll compared to the official release.
• Logs: Entries in the Notepad++ certificate verification log (verifySignedfile log path) showing VerifyComponent: trust verification failed followed by continued execution (pre-patch behavior); absence of expected rejection log entries when a tampered binary is present.
• Process: Unexpected child processes spawned by notepad++.exe or GUP.exe (e.g., cmd.exe, powershell.exe, network tools) that are inconsistent with normal update behavior.
• Network: Outbound connections from GUP.exe to IP addresses or domains not associated with the official Notepad++ update infrastructure (notepad-plus-plus.org) (GitHub Advisory).

Users should upgrade to Notepad++ version 8.9.8 or later, which fixes the vulnerability by enabling full Authenticode chain-of-trust validation (_doCheckChainOfTrust = true) and ensuring WinVerifyTrust failures always result in binary rejection (Fix Commit, v8.9.8 Release). As a workaround for those unable to upgrade immediately, restrict write permissions on the Notepad++ installation directory and updater subdirectory to administrators only, preventing lower-privileged users from replacing updater binaries. Additionally, version 8.9.8.1 was subsequently released and is available from the official site (Notepad++ Downloads).

The vulnerability was reported by researcher "theeomega" and the advisory was published by Notepad++ maintainer "donho" on August 24, 2026. The fix was committed promptly and version 8.9.8 was released the same day, with the release receiving positive community reactions on GitHub (52 reactions). No significant broader media coverage or notable external researcher commentary beyond the advisory itself has been identified (GitHub Advisory, v8.9.8 Release).