Notepad++ is a widely used lightweight text editor that, despite a narrow product scope, occupies a prominent position in the developer and system-administrator landscape. Its vulnerability profile is anchored in the single Notepad++ application, where disclosures reflect the parsing and text-handling demands inherent to a general-purpose editor. Current severity, exploitation activity, and exposure metrics are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Notepad Plus Plus over time
Signals from CVEs in this vendor scope (21 CVEs).
21 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-15556HIGH Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cry | Feb 3, 2026 | 7.5 | 69 | YES | NO |
CVE-2026-48778HIGH Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <GUIConfig name="commandLineInterpreter"> tag in config.xml is read by NppXml::value() (Parameters.cpp | Jun 26, 2026 | 7.8 | 49 | NO | YES |
CVE-2019-16294HIGH SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode characters in a crafted .ml file. | Sep 14, 2019 | 7.8 | 41 | NO | YES |
CVE-2026-52884HIGH Notepad++ is a free and open-source source code editor. In v8.9.6.1, isInTrustedDirectory() does NOT canonicalize the path before checking. It uses a prefix-based check (PathIsPref | Jun 26, 2026 | 7.8 | 37 | NO | NO |
CVE-2026-48800HIGH Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <Command> tag text content inside <UserDefinedCommands> in shortcuts.xml is read by NppXml::value(aNod | Jun 26, 2026 | 7.8 | 36 | NO | NO |
CVE-2026-46710HIGH Notepad++ is a free and open-source source code editor. From 8.9.4 until 8.9.6, Notepad++ contains a local privilege escalation vulnerability in the installer. During installation, | Jun 26, 2026 | 7.8 | 35 | NO | NO |
CVE-2026-52885MEDIUM Notepad++ is a free and open-source source code editor. Prior to 8.9.6.4, NppCommands.cpp checks the HMAC of the on-disk shortcuts.xml at the moment a user command fires (Time-of-C | Jun 26, 2026 | 6.3 | 32 | NO | NO |
CVE-2026-48770MEDIUM Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, a local process in the same interactive Windows session can send a malformed WM_COPYDATA message to Notepa | Jun 26, 2026 | 5.0 | 28 | NO | NO |
CVE-2026-5525HIGH A stack-based buffer overflow vulnerability exists in Notepad++ version 8.9.3 in the file drop handler component. When a user drags and drops a directory path of exactly 259 charac | Apr 10, 2026 | 7.8 | 26 | NO | NO |
CVE-2026-25926HIGH Notepad++ is a free and open-source source code editor. An Unsafe Search Path vulnerability (CWE-426) exists in versions prior to 8.9.2 when launching Windows Explorer without an a | Feb 19, 2026 | 7.3 | 26 | NO | NO |
Signals from CVEs in this vendor scope (21 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Notepad Plus Plus.
Media articles that mention a CVE ID that affects a product developed by Notepad Plus Plus — matched by CVE ID, not by vendor name.