Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification

Notepad++: Stack Buffer Overflow in Plugin Lexer Loading via Unchecked GetLexerCount() Return Value

Notepad++: Path Traversal (Zip Slip) in WinGup Plugin Extraction

Notepad++ “Run by system” executes *.txt.cmd when user selected *.txt (target confusion → command execution)

Notepad++: Stack Buffer Overflow in `NppParameters::writeSession` via overlong session path

Notepad++: Stack Buffer Overflow in expandNppEnvironmentStrs

Notepad++: Arbitrary Code Execution via config.xml commandLineInterpreter

Notepad++: Privilege Escalation in the Installer via Uncontrolled Executable Search Path

Notepad++: Arbitrary Code Execution via shortcuts.xml UserCommand Injection

Notepad++: CVE-2026-48800 Bypass

Notepad++: Authenticode verification bypass allows modified updater execution

Notepad++ has an Untrusted Search Path

Notepad++: Shortcuts.xml macro HMAC bypass still reachable via the "Run a Macro Multiple Times" dialog

Notepad++ TOCTOU: HMAC Checks Disk, Executes from Memory

Notepad++: Null pointer dereference in NPPM_SAVESESSION message handler causes crash (DoS)

Notepad++: shortcuts.xml Macro HMAC Bypass Enables Conditional Elevated Command Execution

Notepad++: Install-time PowerShell command injection through installation path

Notepad++: session.xml backupFilePath starts_with Bypass

Notepad++ WM_COPYDATA COPYDATA_FULL_CMDLINE local DoS crash