What’s Vulnerable › Products
Notepad++ vulnerabilities
21 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.
Check whether your Notepad++ version is affected
Exploited Notepad++ vulnerabilities
- CVE-2025-15556 — Notepad++ Download of Code Without Integrity Check Vulnerability
Latest Notepad++ vulnerabilities
- CVE-2026-52885 — Notepad++ TOCTOU: HMAC Checks Disk, Executes from Memory (CVSS 6.3)
- CVE-2026-52884 — Notepad++: CVE-2026-48800 Bypass (CVSS 7.8)
- CVE-2026-48800 — Notepad++: Arbitrary Code Execution via shortcuts.xml UserCommand Injection (CVSS 7.8)
- CVE-2026-48778 — Notepad++: Arbitrary Code Execution via config.xml commandLineInterpreter (CVSS 7.8)
- CVE-2026-48770 — Notepad++ WM_COPYDATA COPYDATA_FULL_CMDLINE local DoS crash (CVSS 5.0)
- CVE-2026-46710 — Notepad++: Privilege Escalation in the Installer via Uncontrolled Executable Search Path (CVSS 7.8)
- CVE-2026-6539 — Notepad++ 8.9.3 Format String Injection via nativeLang.xml (CVSS 4.4)
- CVE-2026-3008 — Vulnerability in Notepad++ (CVSS 6.6)
- CVE-2026-5525 — Stack-Based Buffer Overflow in Notepad++ File Drop Handler leads to DoS (CVSS 7.8)
- CVE-2026-25926 — Notepad++ has an Untrusted Search Path (CVSS 7.3)
- CVE-2025-15556 — Notepad++ Download of Code Without Integrity Check Vulnerability (CVSS 7.5) — exploited
- CVE-2023-47452 — (CVSS 7.8)
- CVE-2023-6401 — NotePad++ dbghelp.exe uncontrolled search path (CVSS 7.8)
- CVE-2023-40166 — Notepad++ heap buffer read overflow in FileManager::detectLanguageFromTextBegining (CVSS 5.5)
- CVE-2023-40164 — Notepad++ global buffer read overflow in nsCodingStateMachine::NextState (CVSS 5.5)
- CVE-2023-40036 — Notepad++ global buffer read overflow in CharDistributionAnalysis::HandleOneChar (CVSS 5.5)
- CVE-2023-40031 — Notepad++ vulnerable to heap buffer write overflow in Utf8_16_Read::convert (CVSS 7.8)
- CVE-2022-31902 — (CVSS 5.5)
- CVE-2022-31901 — (CVSS 6.5)
- CVE-2022-32168 — notepad-plus-plus - DLL Hijacking (CVSS 7.8)
- CVE-2019-16294 — (CVSS 7.8)