CVE-2026-85995: Notepad++: Authenticode verification bypass allows modified updater execution
Notepad++ is a free and open-source source code editor. From 8.9.7 until 8.9.8, the Notepad++ updater and signature verification path can accept a modified GUP.exe file whose embedded certificate metadata remains present even though its Authenticode digest is invalid. An attacker who can replace or plant the updater-related file can cause Notepad++ to launch attacker-modified code when a user triggers the updater path, but the issue does not provide remote code execution by itself. This issue is fixed in version 8.9.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Notepad++to a version that resolves this vulnerability.Fixed in 8.9.8
Event History
Frequently Asked Questions
Who is exposed to this issue?
Notepad++ installations from version 8.9.7 up to, but not including, 8.9.8 are affected. Exploitation requires an attacker to be able to replace or plant an updater-related file on the affected system.
Does this vulnerability provide remote code execution on its own?
No. The issue does not provide remote code execution by itself; a user must trigger the updater path after an attacker has modified or planted the relevant updater-related file.
What is the remediation?
Update Notepad++ to version 8.9.8, which fixes the updater and signature verification behavior.