PT-2026-20553 · Tabnine · Notepad++
Mariorl0
·
Publicado
2026-02-16
·
Atualizado
2026-03-10
·
CVE-2026-25926
CVSS v3.1
7.3
Alta
| Vetor | AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Notepad++ versions prior to 8.9.2
Description
Notepad++ is a free and open-source source code editor. An Unsafe Search Path issue (CWE-426) exists when launching Windows Explorer without an absolute executable path. This could allow execution of a malicious
explorer.exe if an attacker can control the process working directory. Under certain conditions, this could lead to arbitrary code execution in the context of the running application. The vulnerability was exploited in attacks where malicious actors targeted the update mechanism to distribute malware, such as Chrysalis. The update mechanism now verifies file signatures and XML file signatures from update servers to prevent data tampering and malicious DLL loading.Recommendations
Update Notepad++ to version 8.9.2 or later.
Exploit
Correção
Uncontrolled Search Path Element
Untrusted Search Path
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Notepad++