PT-2026-44374 · Notepad++ · Notepad++

Daniel Cifuentes + 2 · Published 2026-05-26 · Updated 2026-06-29 · CVE-2026-48770

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Notepad++ versions prior to 8.9.6.1

Description Multiple issues exist in the software, including a buffer over-read in the inter-process communication mechanism that can lead to a denial of service. Additionally, remote code execution is possible through configuration file injection because the application passes commandLineInterpreter from 'config.xml' and UserDefinedCommands from 'shortcuts.xml' directly to the ShellExecute() function without validation.

Recommendations Update to version 8.9.6.1.

Exploit

Fix

DoS

RCE

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2026-07492

CVE-2026-48770

GHSA-R39G-3MCW-XCG2

Affected Products

Notepad++

References · 23

• 🔥 https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-r39g-3mcw-xcg2 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48770.json · Exploit
• https://github.com/notepad-plus-plus/notepad-plus-plus/commit/f20a0888a92ce557a339b833cd9d9d8e97dc797d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-48770 · Security Note
• https://bdu.fstec.ru/vul/2026-07492 · Security Note
• https://osv.dev/vulnerability/CVE-2026-48770 · Vendor Advisory
• https://t.me/CSIRT_italia/3563 · Telegram Post
• https://twitter.com/vuldb/status/2061309912148533618 · Twitter Post
• https://t.me/CVEtracker/58146 · Telegram Post
• https://t.me/pentestingnews/74463 · Telegram Post
• https://twitter.com/NullSecurityX/status/2060792603633737822 · Twitter Post
• https://notepad-plus-plus.org/news/v8961-released · Note
• https://t.me/cveNotify/178489 · Telegram Post
• https://twitter.com/piedpiper1616/status/2060544381585948861 · Twitter Post
• https://twitter.com/threatcluster/status/2059945367492251734 · Twitter Post