Loading story…
Notepad++ maintainers patched two separate security flaws across the editor and its updater component, WinGUp. In the main Notepad++ codebase, commit 0a9527e fixed a stack buffer overflow in expandNppEnvironmentStrs by adding bounds checks to prevent writes past a fixed-size wchar_t buffer in RunDlg.cpp. In WinGUp, pull request #106 and commit 7670296 addressed a Zip Slip-style path traversal issue in archive extraction by canonicalizing paths with GetFullPathNameW and rejecting files that would escape the intended destination directory.
The fixes landed without a cited CVE in the referenced commits, but later public discussion linked user concern about download safety to CVE-2026-57233 and to Notepad++'s prior security history. A Reddit thread on upgrade safety said current official downloads, including v8.9.7, appeared legitimate, with commenters pointing to the project's clarification on an earlier incident and noting that one antivirus detection on the MSI installer was likely a false positive. Users also highlighted the project's GitHub releases page as an alternative official source for obtaining installers.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
A Notepad++ commit authored by donho fixes a stack buffer overflow in the expandNppEnvironmentStrs function by adding a bounds check to prevent writes past a fixed-size MAX_PATH stack buffer. The fix is associated with Notepad++ version v8.9.7.
A Reddit thread on r/sysadmin discusses whether current Notepad++ downloads are trustworthy following a recently referenced vulnerability, CVE-2026-57233, and an upgrade to v8.9.7. Commenters point to an official clarification about an earlier security incident and suggest the latest releases appear legitimate.
A wingup commit modifies the archive decompression routine to canonicalize extraction paths and ensure files remain within the intended destination directory, skipping entries that attempt traversal outside the root. The patch explicitly labels the change as a Zip Slip fix.
The wingup pull request for a Zip Slip-style path traversal fix was closed by donho, with the closure associated with merge reference 7670296. The branch fix_zip-slip_path_traversal_issue was also deleted the same day.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
reddit.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Notepad++ released version **8.9.7** with fixes for five security vulnerabilities, including a critical installer-based flaw that could allow **PowerShell command injection** and arbitrary code execution. Reported issues also include a stack buffer overflow, a **Zip Slip** path traversal vulnerability in the `WinGUp` updater, a `session.xml` path validation bypass, and a `shortcuts.xml` macro HMAC integrity bypass. The weaknesses could be exploited through tampered installers, malicious local configuration files, or abuse of update extraction to overwrite files, corrupt memory, bypass protections, or fully compromise a system. The Canadian Centre for Cyber Security issued advisory **AV26-703**, warning that vulnerabilities affect **Notepad++ versions prior to 9.7** and urging users and administrators to review the vendor guidance and apply updates. The notice points to the Notepad++ security advisory and release resources for remediation, while reporting indicates users should update manually rather than wait for the staged auto-updater rollout.
Jul 17, 2026
Notepad++ released **v8.9.2** to harden its update process after a state-linked intrusion enabled attackers to **hijack update traffic** and selectively deliver malware to targeted users. The new “**double-lock**” design adds cryptographic verification of the **signed XML** update metadata returned by `notepad-plus-plus[.]org` (via **XMLDSig**) and complements earlier protections (introduced in **v8.8.9+**) that verify the **signed installer** downloaded from GitHub. Additional security changes to the *WinGUp* auto-updater include removing `libcurl.dll` to reduce DLL side-loading risk, removing insecure cURL SSL options (`CURLSSLOPT_ALLOW_BEAST`, `CURLSSLOPT_NO_REVOKE`), and restricting plugin-management execution to binaries signed with the same certificate as WinGUp. Reporting attributes the compromise to a China-linked actor (including **Lotus Blossom**) that abused a **shared hosting provider-level breach** to intercept and redirect update requests between **June and December 2025**, with selective victim targeting spanning government, telecom, and critical infrastructure—primarily in Southeast Asia but also affecting other regions. The campaign leveraged weaknesses in older WinGUp verification to deliver a malicious **NSIS** installer (`update.exe`) and execute follow-on payloads; described chains include a Lua script injection path delivering **Cobalt Strike** and another using **DLL sideloading** (including abuse of a legitimate Bitdefender component `BluetoothService.exe` to load a malicious `log.dll`) to deploy the **Chrysalis** backdoor. Notepad++ also fixed **CVE-2026-25926** (CVSS 7.3), an **unsafe search path** issue that could allow arbitrary code execution by launching Windows Explorer without an absolute path, potentially enabling execution of a malicious `explorer.exe` if the working directory is attacker-controlled.
Jun 29, 2026
A critical vulnerability in the Notepad++ update mechanism, specifically within the WinGUp updater, allowed attackers to intercept and manipulate network traffic, redirecting update requests to malicious servers. This flaw enabled the silent installation of malware on user systems under the guise of legitimate software updates. Security researchers observed suspicious traffic patterns and confirmed that, in some cases, compromised binaries were delivered instead of genuine Notepad++ installers. The vulnerability stemmed from inadequate validation of the integrity and authenticity of downloaded update files, making it possible for attackers to exploit classic man-in-the-middle techniques and supply-chain attack vectors. In response, Notepad++ developers released an urgent update (v8.8.9) that strengthens the verification process for downloaded installers, now requiring strict digital signature and certificate checks before execution. If these checks fail, the update process is aborted to prevent the execution of untrusted code. The developer acknowledged that the investigation into the exact hijacking method is ongoing, but emphasized that the new security enhancements significantly reduce the risk of similar attacks. Users are advised to manually update to the latest version to ensure protection against this threat.
Jun 29, 2026