Priority CRITICAL 93KEV
Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically verified.
CVSS 4.0HIGH 7.7· Network · No auth · User interaction · EPSS 0.01746 · Published 2026-02-03 · Fixed in 8.8.9 CWE-494
Priority HIGH 69
Notepad++ is a free and open-source source code editor.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00209 · Published 2026-06-26 · Fixed in 8.9.6.1 CWE-78
Priority HIGH 69
Notepad++ is a free and open-source source code editor.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.0062 · Published 2026-06-26 · Fixed in 8.9.6.1 CWE-78
Priority HIGH 69
A stack-based buffer overflow vulnerability exists in Notepad++ version 8.9.3 in the file drop handler component.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00168 · Published 2026-04-10 · Fixed in 8.9.4 CWE-121
Priority HIGH 69
Notepad++ is a free and open-source source code editor.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00517 · Published 2023-08-25 · No fix listed CWE-120
Priority HIGH 68
Notepad++ is a free and open-source source code editor.
CVSS 4.0HIGH 7.5· Local · No auth · No interaction · EPSS 0.00125 · Published 2026-06-26 · Fixed in 8.9.6.4 CWE-367
Priority MEDIUM 62
Buffer overflow in function Notepad_plus::addHotSpot in Notepad++ v8.4.3 and earlier allows attackers to crash the application via two crafted files.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.0133 · Published 2023-01-19 · No fix listed CWE-787
Priority MEDIUM 58
Notepad++ is a free and open-source source code editor.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.00414 · Published 2023-08-25 · No fix listed CWE-120
Priority MEDIUM 58
Notepad++ is a free and open-source source code editor.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.00504 · Published 2023-08-25 · No fix listed CWE-120
Priority MEDIUM 58
Notepad++ v8.4.1 was discovered to contain a stack overflow via the component Finder::add().
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.00524 · Published 2023-02-01 · No fix listed CWE-787
Priority MEDIUM 56
Notepad++ is a free and open-source source code editor.
CVSS 3.1MEDIUM 5.0· Local · Low privileges · User interaction · EPSS 0.00142 · Published 2026-06-26 · Fixed in 8.9.6.1 CWE-125
Priority MEDIUM 46
SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode characters in a crafted .ml file.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.09832 · Published 2019-09-14 · No fix listed CWE-787
Priority LOW 37
Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerable dll (UxTheme.dll) with his own dll and run arbitrary code in the context of Notepad++.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.0075 · Published 2022-09-28 · No fix listed CWE-427
Priority LOW 35
Notepad++ is a free and open-source source code editor.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00208 · Published 2026-06-26 · No fix listed CWE-42
Priority LOW 35
An Untrusted search path vulnerability in notepad++ 6.5 allows local users to gain escalated privileges through the msimg32.dll file in the current working directory.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00535 · Published 2023-11-30 · No fix listed CWE-427
Priority LOW 34
Notepad++ is a free and open-source source code editor.
CVSS 4.0HIGH 7.5· Local · No auth · No interaction · EPSS 0.00152 · Published 2026-06-26 · Fixed in 8.9.6 CWE-426
Priority LOW 34
Notepad++ is a free and open-source source code editor.
CVSS 3.1HIGH 7.3· Local · Low privileges · User interaction · EPSS 0.00273 · Published 2026-02-18 · Fixed in 8.9.2 CWE-426
Priority LOW 34
A vulnerability classified as problematic was found in NotePad++ up to 8.1.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00332 · Published 2023-11-30 · No fix listed CWE-427
Priority LOW 25
Notepad++ is a free and open-source source code editor.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.00375 · Published 2023-08-25 · No fix listed CWE-120
Priority LOW 20
Notepad++ 8.9.3 contains a format string injection vulnerability in the Find Results panel handler that allows attackers to cause denial of service and information disclosure by crafting a malicious nativeLang.xml langua…
CVSS 4.0MEDIUM 4.6· Local · No auth · User interaction · EPSS 0.00191 · Published 2026-04-30 · Fixed in 8.9.4 CWE-134
THREATIST.IORead the docs