CVE-2026-46710: Notepad++ Privilege Escalation Vulnerability

CVE-2026-46710 Overview

CVE-2026-46710 is a local privilege escalation vulnerability in the Notepad++ installer affecting versions 8.9.4 through 8.9.5. The installer invokes powershell.exe without an absolute path after setting the working directory to the installation contextMenu folder. An attacker who pre-places a malicious powershell.exe in a user-writable custom installation directory can gain elevated execution when a privileged user later runs the installer against that directory. The issue is classified as [CWE-426] Untrusted Search Path. Notepad++ 8.9.6 resolves the flaw by resolving the PowerShell path from the registry.

Critical Impact
A staged executable in a user-writable install directory can execute with installer privileges, enabling full local privilege escalation.

Affected Products

Notepad++ 8.9.4
Notepad++ 8.9.5
Fixed in Notepad++ 8.9.6

Discovery Timeline

2026-06-26 - CVE-2026-46710 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-46710

Vulnerability Analysis

The Notepad++ NSIS installer registers a Windows 11 modern context menu by executing an Add-AppxPackage command through PowerShell. The installer invokes powershell as a bare command rather than an absolute path. Before this call, the script sets the working directory to the installation contextMenu subdirectory. Windows resolves unqualified executable names using a search order that includes the current working directory, allowing directory-local binaries to be preferred over the legitimate system binary in C:\Windows\System32\WindowsPowerShell\v1.0\.

Root Cause

The root cause is an untrusted search path [CWE-426] in PowerEditor/installer/nppSetup.nsi. The RegisterMSIX function calls nsExec::ExecToLog 'powershell -Command ...' without qualifying the executable location. When an administrator selects a user-writable installation directory, the search order permits an attacker-controlled powershell.exe placed in that directory to execute instead of the trusted Windows binary.

Attack Vector

Exploitation requires local access and user interaction from a privileged installer. An unprivileged user drops a malicious powershell.exe into a directory they control, for example C:\Users\Public\NppInstall\contextMenu\. When an administrator later runs the Notepad++ installer and selects that directory as the install target, the installer changes into contextMenu and invokes PowerShell. The attacker binary runs under the installer's elevated token, granting SYSTEM or administrator privileges.

text

 Function RegisterMSIX
 	; Windows 11 (build 22000+) is required for modern context menu via MSIX
 	${If} ${AtLeastWin11}
-		nsExec::ExecToLog 'powershell -Command "Add-AppxPackage -Path \"$INSTDIR\contextMenu\NppShell.msix\" -ExternalLocation \"$INSTDIR\contextMenu\""'
+		; Get PowerShell path from the Registry
+		ReadRegStr $0 HKLM "SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell" "Path"
+
+		; Use PowerShell to register a modern Windows 11 right-click context menu silently
+		nsExec::ExecToLog '"$0" -Command "Add-AppxPackage -Path \"$INSTDIR\contextMenu\NppShell.msix\" -ExternalLocation \"$INSTDIR\contextMenu\""'

 		; Wait 2 seconds for the AppX service to finish indexing the new identity
 		Sleep 2000

Source: GitHub Commit 1d4aabe. The patch reads the PowerShell path from HKLM\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell and invokes it via absolute path stored in $0, eliminating the working-directory search.

Detection Methods for CVE-2026-46710

Indicators of Compromise

Presence of powershell.exe in non-standard user-writable directories such as C:\Users\*\Downloads\, C:\Users\Public\, or any custom folder used as a Notepad++ install target.
Notepad++ installer processes (npp.*.Installer.x64.exe) spawning a powershell.exe whose image path resolves outside C:\Windows\System32\ or C:\Windows\SysWOW64\.
Child processes of the installer performing Add-AppxPackage operations followed by unexpected persistence or credential access activity.

Detection Strategies

Alert on parent-child relationships where an NSIS-based installer launches powershell.exe from a non-system path, correlating on process image hash and directory.
Monitor file creation events for powershell.exe written to locations outside %SystemRoot%, particularly in directories that later host installer activity.
Baseline expected Notepad++ installer behavior and flag deviations in child process command lines or working directories.

Monitoring Recommendations

Enable Sysmon Event ID 1 (process create) and Event ID 11 (file create) with rules targeting powershell.exe outside signed system paths.
Forward endpoint process telemetry to a centralized analytics platform and hunt for installer processes launching unsigned or unexpectedly located PowerShell binaries.
Track elevation events (Event ID 4688 with token elevation) that involve installer executables followed by PowerShell child processes.

How to Mitigate CVE-2026-46710

Immediate Actions Required

Upgrade to Notepad++ 8.9.6 or later before running any new install or upgrade.
Instruct administrators to install Notepad++ only to trusted, non-user-writable directories such as C:\Program Files\Notepad++\.
Audit endpoints for stray powershell.exe files residing outside %SystemRoot% and remove any that cannot be attributed to legitimate software.

Patch Information

The fix is applied in commit 1d4aabe2102d982667ead2dd974bee5e0b1f2d9c and released in Notepad++ 8.9.6. Refer to the GitHub Security Advisory GHSA-6f8f-vmfc-r8c5 for the vendor's disclosure. The patch resolves the PowerShell binary path from the registry and invokes it via a fully qualified path.

Workarounds

Do not select user-writable directories as the installation target when running the affected installer with elevated privileges.
Restrict installer execution to standard protected paths under C:\Program Files\, which cannot be written to by standard users.
Apply AppLocker or Windows Defender Application Control policies that only permit powershell.exe execution from C:\Windows\System32\WindowsPowerShell\ and C:\Windows\SysWOW64\WindowsPowerShell\.

bash

# AppLocker rule example: allow PowerShell only from System32/SysWOW64
New-AppLockerPolicy -RuleType Publisher,Path -User Everyone `
  -FileInformation (Get-AppLockerFileInformation -Path "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe") `
  -Optimize | Set-AppLockerPolicy -Merge