CVE-2026-85995: Notepad++ Auth Bypass Vulnerability

CVE-2026-85995 Overview

CVE-2026-85995 is a signature verification bypass affecting the Notepad++ updater component (GUP.exe) in versions 8.9.7 through 8.9.7. The vulnerability allows a modified GUP.exe file to pass Notepad++ signature checks even when its Authenticode digest is invalid, provided that embedded certificate metadata remains present. An attacker who can place or replace the updater-related file on disk can cause Notepad++ to execute attacker-modified code when the updater path runs. The flaw is categorized as [CWE-347] Improper Verification of Cryptographic Signature. Notepad++ 8.9.8 addresses the issue by enabling full chain-of-trust validation.

Critical Impact
A local attacker with write access to the updater file can trigger execution of tampered code through the trusted Notepad++ update path, bypassing Authenticode digest validation.

Affected Products

Notepad++ 8.9.7
Notepad++ updater component GUP.exe
Signature verification routine in PowerEditor/src/MISC/Common/verifySignedfile.cpp

Discovery Timeline

2026-09-22 - CVE-2026-85995 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-85995

Vulnerability Analysis

The Notepad++ signature verification routine calls WinVerifyTrust with the WINTRUST_ACTION_GENERIC_VERIFY_V2 policy to validate the Authenticode signature of GUP.exe before invoking the updater. In vulnerable builds, the routine checks the presence of embedded certificate metadata but does not enforce chain-of-trust validation. As a result, a modified binary whose Authenticode digest no longer matches the signed content can still be accepted as trusted. When a user triggers the updater path, Notepad++ launches the attacker-modified GUP.exe, executing arbitrary code within the user's context. The issue does not permit remote code execution on its own. It requires prior local file placement and user interaction to trigger the update workflow.

Root Cause

The root cause is a configuration flag in the signature verification class: _doCheckChainOfTrust was set to false by default. This disabled full validation of the certificate chain and allowed binaries with tampered Authenticode digests to be treated as valid as long as the signer metadata was intact.

Attack Vector

Exploitation requires local access with write permissions to the Notepad++ installation directory or the updater file location. An attacker replaces GUP.exe with a modified copy that retains the original certificate metadata. When the user launches Notepad++ and triggers the update check, the trusted verification path loads and executes the malicious binary.

cpp

// Security patch in PowerEditor/src/MISC/Common/verifySignedfile.cpp
	{
		// Verify signature and cert-chain validity
		GUID policy = WINTRUST_ACTION_GENERIC_VERIFY_V2;
-		LONG vtrust = ::WinVerifyTrust(NULL, &policy, &winTEXTrust_data);
+		LONG hasError = ::WinVerifyTrust(NULL, &policy, &winTEXTrust_data);

		// Post check cleanup
		winTEXTrust_data.dwStateAction = WTD_STATEACTION_CLOSE;
		LONG t2 = ::WinVerifyTrust(NULL, &policy, &winTEXTrust_data);

-		if (vtrust)
+		if (hasError)
		{
-			if (doLogCertifError)
-				writeCertVerifLog(errorLogPath.c_str(), L"VerifyComponent: trust verification failed");
-
+			writeCertVerifLog(errorLogPath.c_str(), L"VerifyComponent: trust verification failed");
			return false;
		}

// Header change in PowerEditor/src/MISC/Common/verifySignedfile.h
-	bool _doCheckChainOfTrust = false;
+	bool _doCheckChainOfTrust = true;

Source: GitHub Commit 9edf40f

Detection Methods for CVE-2026-85995

Indicators of Compromise

Modified GUP.exe file in the Notepad++ updater directory with a modification timestamp inconsistent with the installed Notepad++ version.
GUP.exe binaries whose Authenticode digest fails validation via signtool verify /pa /v but that still load through Notepad++.
Child processes spawned by notepad++.exe or GUP.exe that initiate outbound network connections to non-Notepad++ update endpoints.

Detection Strategies

Monitor file integrity of GUP.exe and other files within the Notepad++ installation directory using endpoint file integrity monitoring.
Enumerate installed Notepad++ versions across the environment and flag hosts running 8.9.7 or earlier that have not upgraded to 8.9.8.
Alert on process creation events where GUP.exe is launched from a non-standard path or with unexpected command-line arguments.

Monitoring Recommendations

Track write operations to %ProgramFiles%\Notepad++\updater\ and %LOCALAPPDATA%\Notepad++\ by non-installer processes.
Log and review WinVerifyTrust verification failures for third-party signed binaries on user endpoints.
Correlate Notepad++ update workflow execution with outbound network traffic to detect unauthorized update sources.

How to Mitigate CVE-2026-85995

Immediate Actions Required

Upgrade all Notepad++ installations to version 8.9.8 or later.
Audit the Notepad++ installation directory on endpoints for unauthorized modifications to GUP.exe.
Restrict write permissions on %ProgramFiles%\Notepad++\ so that only administrators can modify the updater binary.

Patch Information

Notepad++ 8.9.8 fixes the vulnerability by setting _doCheckChainOfTrust to true in the signature verification class, forcing WinVerifyTrust to validate the full certificate chain. See the Notepad++ 8.9.8 Release, the GitHub Security Advisory GHSA-cx87-7hhq-m2j3, and the Notepad++ News Release v8.9.8 for full details.

Workarounds

Disable the Notepad++ auto-updater until 8.9.8 can be deployed, and manage updates through a controlled software distribution channel.
Apply application allowlisting policies to prevent execution of unsigned or tampered binaries from user-writable directories.
Enforce least-privilege on end-user accounts so that standard users cannot write to the Notepad++ installation path.

bash

# Verify Authenticode signature of GUP.exe using signtool
signtool verify /pa /v "C:\Program Files\Notepad++\updater\GUP.exe"

# PowerShell: enumerate Notepad++ version across hosts
Get-ItemProperty "C:\Program Files\Notepad++\notepad++.exe" |
  Select-Object -ExpandProperty VersionInfo |
  Format-List FileVersion, ProductVersion

# Remove write access for non-administrators on the updater directory
icacls "C:\Program Files\Notepad++\updater" /inheritance:r /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "Users:(OI)(CI)RX"