Vendor
Notepad++
32 known vulnerabilities in products by Notepad++, 1 of them actively exploited (CISA KEV).
Key figures
32
Vulnerabilities
1
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-15556 | Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification In CISA KEV | 7.5 | |
| High | CVE-2019-16294 | Scintilla: Denial of Service | 7.8 | |
| High | CVE-2026-57233 | Notepad++: Path Traversal (Zip Slip) in WinGup Plugin Extraction | 8.1 | |
| High | CVE-2026-48778 | Notepad++: Arbitrary Code Execution via config.xml commandLineInterpreter | 7.8 | |
| Medium | CVE-2022-31901 | Notepad++: Buffer Overflow | 6.5 | |
| High | CVE-2026-85279 | Notepad++: Stack Buffer Overflow in Plugin Lexer Loading via Unchecked GetLexerCount() Return Value | 8.6 | |
| High | CVE-2025-49144 | Notepad++ Privilege Escalation in Installer via Uncontrolled Executable Search Path | 7.3 | |
| High | CVE-2026-86054 | Notepad++: Stack Buffer Overflow in `NppParameters::writeSession` via overlong session path | 7.8 | |
| High | CVE-2026-77605 | Notepad++ Project Notepad-plus-plus: Improper Input Validation | 7.8 | |
| High | CVE-2022-32168 | notepad-plus-plus - DLL Hijacking | 7.8 | |
| High | CVE-2026-85995 | Notepad++: Authenticode verification bypass allows modified updater execution | 7.3 | |
| High | CVE-2026-54758 | Notepad++: Stack Buffer Overflow in expandNppEnvironmentStrs | 7.8 | |
| Medium | CVE-2026-85288 | Notepad++ Project Notepad-plus-plus: OS Command Injection | 6.7 | |
| High | CVE-2023-47452 | Notepad++: security vulnerability | 7.8 | |
| High | CVE-2026-48800 | Notepad++: Arbitrary Code Execution via shortcuts.xml UserCommand Injection | 7.8 | |
| High | CVE-2026-52884 | Notepad++: CVE-2026-48800 Bypass | 7.8 | |
| High | CVE-2026-46710 | Notepad++: Privilege Escalation in the Installer via Uncontrolled Executable Search Path | 7.8 | |
| High | CVE-2023-40031 | Notepad++ vulnerable to heap buffer write overflow in Utf8_16_Read::convert | 7.8 | |
| High | CVE-2026-52885 | Notepad++ TOCTOU: HMAC Checks Disk, Executes from Memory | 6.3 | |
| High | CVE-2026-5525 | Stack-Based Buffer Overflow in Notepad++ File Drop Handler leads to DoS | 7.8 | |
| Medium | CVE-2026-86056 | Notepad++: Null pointer dereference in NPPM_SAVESESSION message handler causes crash (DoS) | 5.5 | |
| High | CVE-2026-25926 | Notepad++ has an Untrusted Search Path | 7.3 | |
| Medium | CVE-2026-73250 | Notepad++: Install-time PowerShell command injection through installation path | — | |
| Medium | CVE-2026-71858 | Notepad++: shortcuts.xml Macro HMAC Bypass Enables Conditional Elevated Command Execution | — | |
| Medium | CVE-2026-52886 | Notepad++: session.xml backupFilePath starts_with Bypass | — |
Products
| Notepad-plus-plus | 25 | 1 |
| Notepad\+\+ | 20 | 1 |