CVE-2026-77605: Notepad++ RCE Vulnerability

CVE-2026-77605 Overview

CVE-2026-77605 is a target confusion vulnerability in Notepad++ versions prior to 8.9.8. The flaw resides in the Folder as Workspace (FaW) Run by system action, which can resolve a sibling file instead of the file the user selected. An attacker who plants a .cmd script whose name matches the selected text file path with .cmd appended can trick Notepad++ into executing that script as the current user on Windows 10 and Windows 11. The issue is classified under [CWE-20] Improper Input Validation and is fixed in Notepad++ 8.9.8.

Critical Impact
Local code execution as the current user when a victim invokes Run by system on a text file that shares a directory with an attacker-planted .cmd script.

Affected Products

Notepad++ versions prior to 8.9.8
Windows 10 installations running vulnerable Notepad++ builds
Windows 11 installations running vulnerable Notepad++ builds

Discovery Timeline

2026-09-22 - CVE-2026-77605 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-77605

Vulnerability Analysis

The vulnerability lives in the Folder as Workspace feature of Notepad++. When a user right-clicks a file in the FaW pane and selects Run by system, the editor invokes ShellExecute on the selected path. Windows shell resolution can locate a sibling executable script whose base name matches the selected file with .cmd appended, causing that script to launch instead of opening the text file. The result is arbitrary command execution in the security context of the user running Notepad++.

User interaction is required, but the workflow is common for developers browsing project directories. Successful exploitation grants full read, write, and execute access to any resource the user account can reach.

Root Cause

The root cause is improper input validation and unsafe path handling in the IDM_FILEBROWSER_SHELLEXECUTE handler within PowerEditor/src/WinControls/FileBrowser/fileBrowser.cpp. The original code passed the node path directly to ShellExecute, allowing Windows shell resolution to substitute a sibling .cmd file for the intended text target.

Attack Vector

An attacker must first place a malicious .cmd file alongside a text file inside a directory the victim opens as a Folder as Workspace. The victim then selects the text file in the FaW pane and invokes Run by system. Notepad++ hands the path to the shell, which resolves and launches the sibling .cmd script under the victim's account.

cpp

		case IDM_FILEBROWSER_SHELLEXECUTE:
		{
			if (!selectedNode) return;
-			wstring path = getNodePath(selectedNode);
+			wstring literalPath = L"\\\\?\\" + getNodePath(selectedNode);

-			if (doesPathExist(path.c_str()))
-				::ShellExecute(NULL, L"open", path.c_str(), NULL, NULL, SW_SHOWNORMAL);
+			if (doesPathExist(literalPath.c_str()))
+			{
+				SHELLEXECUTEINFO sei{};
+				sei.cbSize = sizeof(sei);
+				sei.fMask = SEE_MASK_FLAG_NO_UI;
+				sei.lpVerb = L"open";
+				sei.lpFile = literalPath.c_str();
+				sei.nShow = SW_SHOWNORMAL;
+				::ShellExecuteEx(&sei);
+			}
		}
		break;

Source: GitHub Commit 00fa5df0. The patch prepends the \\?\ literal path prefix and switches to ShellExecuteEx, forcing Windows to treat the string as an exact path and disabling shell name resolution that would pick up the sibling .cmd file.

Detection Methods for CVE-2026-77605

Indicators of Compromise

Presence of .cmd files with names matching adjacent text files inside directories used as a Notepad++ Folder as Workspace.
Process creation events where notepad++.exe is the parent of cmd.exe or an interpreter launched from a user document directory.
Unexpected child processes spawned from Notepad++ shortly after a user opens a workspace received from an external source (email attachment, ZIP, cloned repository).

Detection Strategies

Hunt for parent-child relationships where notepad++.exe spawns cmd.exe, powershell.exe, or other script interpreters using EDR process telemetry.
Alert on writes of .cmd, .bat, or executable files into directories that also contain non-executable text files delivered by untrusted sources.
Baseline installed Notepad++ versions across the fleet and flag any host running a build older than 8.9.8.

Monitoring Recommendations

Ingest Windows process creation events (Event ID 4688 or Sysmon Event ID 1) into a central data lake for retrospective hunting.
Monitor file creation events (Sysmon Event ID 11) in user document, download, and repository directories for suspicious .cmd drops.
Track command-line arguments of shell processes launched from GUI editors to identify scripted payload execution patterns.

How to Mitigate CVE-2026-77605

Immediate Actions Required

Upgrade all Notepad++ installations to version 8.9.8 or later using the official installer from the Notepad++ v8.9.8 release notes.
Instruct users to avoid opening untrusted directories as a Folder as Workspace until patching is complete.
Audit endpoints for Notepad++ versions and prioritize developer and analyst workstations that routinely open external project folders.

Patch Information

The fix is delivered in Notepad++ 8.9.8 and tracked in GitHub Security Advisory GHSA-w5xq-frjg-w4cw. The patch replaces ShellExecute with ShellExecuteEx and applies the \\?\ extended-length path prefix so Windows resolves the exact user-selected file. Binary downloads are available on the GitHub v8.9.8 release page.

Workarounds

Disable use of the Folder as Workspace Run by system action on hosts running pre-8.9.8 builds.
Scan workspace directories for .cmd or .bat files whose base name mirrors an adjacent text file, and remove any that are not expected.
Apply application allowlisting (for example, Windows Defender Application Control) to block execution of unsigned scripts from user-writable directories.

bash

# Verify the installed Notepad++ version on Windows via PowerShell
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Notepad++" |
  Select-Object DisplayName, DisplayVersion

# Fleet check: list workstations still running builds older than 8.9.8
Get-CimInstance Win32_Product -Filter "Name LIKE 'Notepad++%'" |
  Where-Object { [version]$_.Version -lt [version]'8.9.8' } |
  Select-Object PSComputerName, Name, Version