{"id":259172,"date":"2026-05-29T18:51:00","date_gmt":"2026-05-29T22:51:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/05\/29\/critical-notepad-vulnerabilities-allow-attackers-to-execute-arbitrary-code\/"},"modified":"2026-05-29T19:10:10","modified_gmt":"2026-05-29T23:10:10","slug":"critical-notepad-vulnerabilities-allow-attackers-to-execute-arbitrary-code","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/05\/29\/critical-notepad-vulnerabilities-allow-attackers-to-execute-arbitrary-code\/","title":{"rendered":"Critical Notepad++ Vulnerabilities Allow Attackers to Execute Arbitrary Code"},"content":{"rendered":"

Critical Notepad++ Vulnerabilities Allow Attackers to Execute Arbitrary Code<\/a><\/p>\n

https:\/\/cybersecuritynews.com\/critical-notepad-vulnerabilities\/<\/a><\/p>\n

Publish Date: 2026-05-29 18:51:00<\/a><\/p>\n

Source Domain: cybersecuritynews.com<\/a><\/p>\n

Notepad++, one of the most widely used open-source text editors for Windows, has released an urgent security update addressing three vulnerabilities, including two arbitrary code execution flaws that could allow attackers to silently run malicious programs on a victim\u2019s machine.<\/p>\n

The Notepad++ development team released version v8.9.6.1 on May 26, 2026, patching all three vulnerabilities. Users running v8.9.6 or earlier are urged to update immediately.<\/p>\n

Notepad++ Vulnerabilities<\/strong><\/h2>\n

The update resolves the following vulnerabilities:<\/p>\n\n\n\n\n\n
CVE ID<\/th>\nSeverity<\/th>\nDescription<\/th>\n<\/tr>\n
CVE-2026-48770<\/td>\nHigh<\/td>\nCrash via malformed XML structure<\/td>\n<\/tr>\n
CVE-2026-48778<\/td>\nCritical<\/td>\nArbitrary code execution via config.xml<\/td>\n<\/tr>\n
CVE-2026-48800<\/td>\nCritical<\/td>\nArbitrary code execution via shortcuts.xml<\/td>\n<\/tr>\n<\/table>\n

The most severe of the three is CVE-2026-48778, which targets the tag inside Notepad++\u2019s config.xml file.<\/p>\n

The editor reads this value through NppXml::value() in Parameters.cpp and stores it without any validation, whitelist, or digital signature check.<\/p>\n

When a user triggers File \u2192 Open Containing Folder \u2192 cmd, the application creates a command object using the attacker-controlled string and passes it directly to ShellExecute() effectively executing whatever executable the attacker has planted.<\/p>\n

A simple proof-of-concept payload placing calc.exe in the XML tag causes Windows Calculator to launch instead of the intended command prompt, confirming full code execution capability.<\/p>\n

Researchers identified several realistic paths an attacker could exploit CVE-2026-48778:<\/p>\n