CVE-2026-25926: Notepad++ RCE Vulnerability

CVE-2026-25926 Overview

CVE-2026-25926 is an Unsafe Search Path vulnerability (CWE-426) affecting Notepad++, a popular free and open-source source code editor used by developers and IT professionals worldwide. The vulnerability exists in versions prior to 8.9.2 when the application launches Windows Explorer without specifying an absolute executable path. This flaw may allow attackers to execute a malicious explorer.exe if they can control the process working directory, potentially leading to arbitrary code execution in the context of the running application.

Critical Impact

Attackers who can control the working directory may achieve arbitrary code execution by planting a malicious explorer.exe binary, compromising the integrity and confidentiality of the affected system.

Affected Products

• Notepad++ versions prior to 8.9.2
• All platforms running vulnerable Notepad++ installations on Windows

Discovery Timeline

• 2026-02-19 - CVE-2026-25926 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-25926

Vulnerability Analysis

This vulnerability stems from an Unsafe Search Path issue (CWE-426) in Notepad++. When the application needs to launch Windows Explorer, it does so without specifying the full absolute path to the explorer.exe executable. On Windows systems, when an application executes a program without an absolute path, the operating system searches through a series of directories in a specific order to locate the executable.

If an attacker can influence the process's current working directory—for example, by convincing a user to open a malicious project folder or document from a compromised location—they could place a trojanized explorer.exe in that directory. When Notepad++ attempts to launch Explorer, the malicious executable would be found and executed first, running with the same privileges as the Notepad++ process.

Root Cause

The root cause is the use of a relative or unqualified path when invoking explorer.exe instead of using the absolute system path (typically C:\Windows\explorer.exe). This coding pattern violates secure development practices for executable invocation on Windows systems, where the search order can be manipulated through various means including the current working directory.

Attack Vector

The attack requires local access and user interaction. An attacker would need to:

1. Plant a malicious explorer.exe file in a directory that will become the working directory for Notepad++
2. Convince the victim to open a file or project from that location using Notepad++
3. Trigger the functionality in Notepad++ that launches Windows Explorer

When successful, the malicious executable runs in the security context of the current user, potentially allowing data theft, persistence mechanisms, or further system compromise.

The vulnerability exploitation typically involves social engineering to get users to work with files from attacker-controlled locations, making it a targeted attack vector rather than a widespread automated exploitation scenario.

Detection Methods for CVE-2026-25926

Indicators of Compromise

• Presence of explorer.exe files in non-standard locations, particularly in project directories or document folders
• Process execution events showing explorer.exe launched from directories other than C:\Windows
• Notepad++ spawning child processes with unexpected executable paths

Detection Strategies

• Monitor for process creation events where explorer.exe is executed from paths outside the Windows system directory
• Implement application whitelisting to prevent execution of unsigned or non-standard executables named explorer.exe
• Deploy endpoint detection rules that alert on DLL sideloading and binary planting patterns

Monitoring Recommendations

• Enable detailed Windows process auditing (Event ID 4688) with command line logging
• Use SentinelOne's behavioral AI to detect anomalous process relationships and execution patterns
• Review Notepad++ installation directories and working directories for suspicious executables

How to Mitigate CVE-2026-25926

Immediate Actions Required

• Upgrade Notepad++ to version 8.9.2 or later immediately
• Audit systems for any explorer.exe files located outside the Windows system directory
• Review recent Notepad++ activity logs for any suspicious behavior
• Implement application control policies to restrict executable execution to known-good paths

Patch Information

Notepad++ version 8.9.2 addresses this vulnerability by using an absolute path when launching Windows Explorer. Organizations should update to this version through their standard software deployment processes. The patch is available through the official GitHub Release v8.9.2 page. Additional details can be found in the Notepad++ v8.9.2 release announcement and the GitHub Security Advisory GHSA-rjvm-fcxw-2jxq.

Workarounds

• Avoid opening files or projects from untrusted or network locations until the patch is applied
• Implement folder permission restrictions to prevent unauthorized file creation in commonly accessed directories
• Use application sandboxing to limit the impact of potential exploitation
• Configure Windows Defender Application Control (WDAC) policies to block unsigned executables

# Check for suspicious explorer.exe files outside Windows directory
Get-ChildItem -Path C:\ -Filter "explorer.exe" -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.DirectoryName -notmatch "Windows" }