CVE-2026-25926: Notepad++ RCE Vulnerability

CVE-2026-25926 Overview

CVE-2026-25926 is an Unsafe Search Path vulnerability (CWE-426) affecting Notepad++, a popular free and open-source source code editor used by developers and IT professionals worldwide. The vulnerability exists in versions prior to 8.9.2 when the application launches Windows Explorer without specifying an absolute executable path. This flaw may allow attackers to execute a malicious explorer.exe if they can control the process working directory, potentially leading to arbitrary code execution in the context of the running application.

Critical Impact
Attackers who can control the working directory may achieve arbitrary code execution by planting a malicious explorer.exe binary, compromising the integrity and confidentiality of the affected system.

Affected Products

Notepad++ versions prior to 8.9.2
All platforms running vulnerable Notepad++ installations on Windows

Discovery Timeline

2026-02-19 - CVE-2026-25926 published to NVD
2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-25926

Vulnerability Analysis

This vulnerability stems from an Unsafe Search Path issue (CWE-426) in Notepad++. When the application needs to launch Windows Explorer, it does so without specifying the full absolute path to the explorer.exe executable. On Windows systems, when an application executes a program without an absolute path, the operating system searches through a series of directories in a specific order to locate the executable.

If an attacker can influence the process's current working directory—for example, by convincing a user to open a malicious project folder or document from a compromised location—they could place a trojanized explorer.exe in that directory. When Notepad++ attempts to launch Explorer, the malicious executable would be found and executed first, running with the same privileges as the Notepad++ process.

Root Cause

The root cause is the use of a relative or unqualified path when invoking explorer.exe instead of using the absolute system path (typically C:\Windows\explorer.exe). This coding pattern violates secure development practices for executable invocation on Windows systems, where the search order can be manipulated through various means including the current working directory.

Attack Vector

The attack requires local access and user interaction. An attacker would need to:

Plant a malicious explorer.exe file in a directory that will become the working directory for Notepad++
Convince the victim to open a file or project from that location using Notepad++
Trigger the functionality in Notepad++ that launches Windows Explorer

When successful, the malicious executable runs in the security context of the current user, potentially allowing data theft, persistence mechanisms, or further system compromise.

The vulnerability exploitation typically involves social engineering to get users to work with files from attacker-controlled locations, making it a targeted attack vector rather than a widespread automated exploitation scenario.

Detection Methods for CVE-2026-25926

Indicators of Compromise

Presence of explorer.exe files in non-standard locations, particularly in project directories or document folders
Process execution events showing explorer.exe launched from directories other than C:\Windows
Notepad++ spawning child processes with unexpected executable paths

Detection Strategies

Monitor for process creation events where explorer.exe is executed from paths outside the Windows system directory
Implement application whitelisting to prevent execution of unsigned or non-standard executables named explorer.exe
Deploy endpoint detection rules that alert on DLL sideloading and binary planting patterns

Monitoring Recommendations

Enable detailed Windows process auditing (Event ID 4688) with command line logging
Use SentinelOne's behavioral AI to detect anomalous process relationships and execution patterns
Review Notepad++ installation directories and working directories for suspicious executables

How to Mitigate CVE-2026-25926

Immediate Actions Required

Upgrade Notepad++ to version 8.9.2 or later immediately
Audit systems for any explorer.exe files located outside the Windows system directory
Review recent Notepad++ activity logs for any suspicious behavior
Implement application control policies to restrict executable execution to known-good paths

Patch Information

Notepad++ version 8.9.2 addresses this vulnerability by using an absolute path when launching Windows Explorer. Organizations should update to this version through their standard software deployment processes. The patch is available through the official GitHub Release v8.9.2 page. Additional details can be found in the Notepad++ v8.9.2 release announcement and the GitHub Security Advisory GHSA-rjvm-fcxw-2jxq.

Workarounds

Avoid opening files or projects from untrusted or network locations until the patch is applied
Implement folder permission restrictions to prevent unauthorized file creation in commonly accessed directories
Use application sandboxing to limit the impact of potential exploitation
Configure Windows Defender Application Control (WDAC) policies to block unsigned executables

bash

# Check for suspicious explorer.exe files outside Windows directory
Get-ChildItem -Path C:\ -Filter "explorer.exe" -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.DirectoryName -notmatch "Windows" }