CVE-2026-46710: Notepad++ Installer Privilege Escalation Vulnerability

Technical summary

The vulnerability stems from an untrusted search-path issue (CWE-426) where the Notepad++ installer invokes powershell.exe using a relative rather than absolute path. After the installer changes the working directory to a user-controllable custom installation location (the contextMenu directory), a subsequent call to PowerShell without a fully qualified path allows an attacker to substitute their own executable. If a privileged user runs the installer and selects that compromised directory, the attacker's powershell.exe inherits the installer's elevated token, resulting in arbitrary code execution with administrative privileges.

Business impact

Organizations using Notepad++ in shared or multi-user environments face risk during software updates. An unprivileged user could escalate their access by preparing a malicious payload and waiting for an administrator to install or upgrade Notepad++. Compromised administrative accounts could lead to lateral movement, data exfiltration, malware deployment, or persistent system compromise. The attack requires social engineering or environmental access but yields direct privilege escalation.

Affected systems

Notepad++ versions 8.9.4, 8.9.5, and 8.9.6 are vulnerable. The issue is specific to the Windows installer and affects any installation where a user selects a custom installation directory. Users running Notepad++ as a portable application or using Linux/macOS versions are not impacted.

Exploitability

This vulnerability requires local access and user interaction—the attacker must place a malicious executable beforehand and rely on a privileged user choosing a custom installation directory and running the installer. While not remotely exploitable, the barrier to exploitation is moderate for an attacker with system access. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities list as of the source data timestamp.

Remediation

Upgrade to Notepad++ 8.9.6 or later immediately. When running the installer, ensure you accept the default installation directory or verify that any custom directory has not been tampered with. Organizations should push updates through standard patch management workflows and consider blocking older versions where feasible.

Patch guidance

Download and install Notepad++ 8.9.6 from the official Notepad++ website (notepad-plus-plus.org). The patch corrects the path resolution issue by using absolute paths for PowerShell invocation. Verify the integrity of downloaded files using the publisher's checksum if available. Organizations can script or automate installation with the fixed version for consistency across endpoints.

Detection guidance

Monitor for failed installer executions or unexpected PowerShell processes spawned from user-writable directories during Notepad++ installation. Look for process trees where powershell.exe appears to be running from a non-standard path. Event log analysis on vulnerable systems can reveal abnormal execution patterns. File integrity monitoring on installation directories may detect unauthorized executable placement. Endpoint Detection and Response (EDR) tools should alert on suspicious child processes launched by installer executables running with high privilege.

Why prioritize this

Although the vulnerability requires local access and user interaction, it yields complete system compromise via privilege escalation (CVSS 7.8, HIGH severity). Organizations with mixed-privilege user bases or shared development machines should prioritize patching. The relatively simple attack pattern and high impact merit swift remediation, though remote exposure is limited compared to network-based vulnerabilities.

Risk score, explained

CVSS 3.1 score of 7.8 reflects a high-severity local privilege escalation with high impact on confidentiality, integrity, and availability. The attack vector is local (AV:L), requires no special privileges (PR:N), and necessitates user interaction (UI:R) but succeeds once activated. The undiscovered/unreliable nature of exploitation and lack of widespread public tooling moderate the practical risk somewhat, but the severity remains substantial for environments where Notepad++ is used.

Frequently asked questions