--- title: "Notepad++ vulnerabilities could enable arbitrary code execution on Windows systems" url: https://daily.dev/posts/notepad-vulnerabilities-could-enable-arbitrary-code-execution-on-windows-systems-lzftq7gmz source_url: https://www.csoonline.com/article/4178622/notepad-vulnerabilities-could-enable-arbitrary-code-execution-on-windows-systems.html type: article source: "CSO Online" published: 2026-05-29T09:40:26.084Z updated: 2026-05-29T09:40:59.974Z tags: ["security"] reading_time: 4 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Notepad++ vulnerabilities could enable arbitrary code execution on Windows systems **[CSO Online](https://daily.dev/sources/csoonline)** · 4 min read · 0 upvotes · 0 comments ## Summary Two high-severity arbitrary code execution vulnerabilities (CVE-2026-48778 and CVE-2026-48800, CVSS 7.8) have been discovered in Notepad++ affecting all versions up to 8.9.6. Both flaws exploit the editor's XML configuration files — shortcuts.xml and config.xml — which store user-defined commands and the command-line interpreter path without any validation. A local attacker who can write to these files can inject malicious executables that survive reboots and blend into the Run menu as legitimate-looking entries. A third lower-severity crash bug (CVE-2026-48770, CVSS 5.0) was also patched. All three were fixed in version 8.9.6.1, released the same day as disclosure. Users are advised to monitor AppData for unexpected changes to the affected XML files, as the attack leaves no trace in the installation directory or binary. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Notepad\+\+ declares new update process 'unexploitable'](https://daily.dev/posts/notepad-declares-new-update-process-unexploitable--zjrjkirkg) · The Register · 0 upvotes · 0 comments - [What to Know About the Notepad\+\+ Supply-Chain Attack](https://daily.dev/posts/what-to-know-about-the-notepad-supply-chain-attack-9d1xjpbjc) · Security Boulevard · 0 upvotes · 0 comments - [Notepad's new Markdown powers served with a side of RCE](https://daily.dev/posts/notepad-s-new-markdown-powers-served-with-a-side-of-rce-t0qp7yo7u) · The Register · 0 upvotes · 0 comments - [Hackers abuse Notepad\+\+ plugins to stealthily install malware](https://daily.dev/posts/hackers-abuse-notepad-plugins-to-stealthily-install-malware-qqzgtilfh) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/notepad-vulnerabilities-could-enable-arbitrary-code-execution-on-windows-systems-lzftq7gmz)