Insecure Updater Path in Notepad++ Allows Code Execution

Executive Summary

CVE-2026-85995 is an Authenticode verification bypass in Notepad++ versions 8.9.7 to 8.9.8. The updater and signature verification path incorrectly accepts a modified GUP.exe file if its embedded certificate metadata is present, even if the Authenticode digest is invalid. This allows an attacker to replace updater files with malicious versions that retain the original certificate but contain altered code. Notepad++ will execute these files, bypassing proper verification.

Useful 0 Not Useful 0

Impact Analysis

An attacker with local access could replace Notepad++ updater files with malicious versions. When you trigger the updater, it would execute the attacker's code instead of the legitimate update. This could lead to unauthorized code execution on your system, but does not provide remote code execution by itself. It weakens the security of Notepad++ updates.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized code execution on systems handling sensitive data. For GDPR, it may violate integrity requirements for processing personal data. For HIPAA, it could compromise the security of protected health information. Organizations using Notepad++ in regulated environments should update to version 8.9.8 to mitigate risks.

Useful 0 Not Useful 0

Mitigation Strategies

Update Notepad++ to version 8.9.8 or later to address the Authenticode verification bypass in the updater mechanism.

• Verify that the updater and Plugins Admin components enforce full Authenticode verification by checking file digests and certificate chains.
• Monitor for unauthorized modifications to updater-related files like GUP.exe or nppPluginList.dll.

Useful 0 Not Useful 0