PT-2026-44401 · Notepad++ · Notepad++

Published 2026-05-26 · Updated 2026-06-02 · CVE-2026-48800

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Notepad++ (affected versions not specified)

Description Multiple issues exist in the software. The config.xml configuration file fails to neutralize special elements when processing the commandLineInterpreter parameter. Additionally, the shortcuts.xml configuration file does not properly neutralize special elements. Both of these issues could allow an attacker to execute arbitrary code. Furthermore, a memory out-of-bounds read in the inter-process communication mechanism could lead to a denial of service (DoS), which is a condition where the application becomes unavailable to users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

OS Command Injection

Weakness Enumeration

CWE-125

CWE-78

Related Identifiers

BDU:2026-07492

BDU:2026-07493

BDU:2026-07494

CVE-2026-48800

Affected Products

Notepad++

References · 20

• https://bdu.fstec.ru/vul/2026-07493 · Security Note
• https://bdu.fstec.ru/vul/2026-07494 · Security Note
• https://bdu.fstec.ru/vul/2026-07492 · Security Note
• https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-r39g-3mcw-xcg2 · Note
• https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-7hm3-wp5q-ccv9 · Note
• https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-3x3f-3j39-pj3v · Note
• https://acn.gov.it/portale/w/notepad-poc-pubblici-per-le-cve-2026-48800-cve-2026-48778-e-cve-2026-48770 · Note
• https://t.me/ZerodayAlert/720 · Telegram Post
• https://notepad-plus-plus.org/news/v8961-released · Note
• https://t.me/CSIRT_italia/3571 · Telegram Post
• https://twitter.com/mwbengtsson/status/2061752320531079345 · Twitter Post
• https://t.me/CSIRT_italia/3563 · Telegram Post
• https://reddit.com/r/CVEWatch/comments/1tqx4fa/top_10_trending_cves_29052026 · Reddit Post
• https://community.notepad-plus-plus.org/topic/27548/notepad-release-8.9.6.1 · Note
• https://thecyberexpress.com/notepad-cve-2026-48770-vulnerability · Note