Is CVE-2026-25926 actively exploited?

CVE-2026-25926 has no public evidence of in-the-wild exploitation as of 2026-02-19.

What is the CVSS score for CVE-2026-25926?

CVE-2026-25926 has a CVSS score of 7.3 (HIGH severity). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.

How do I patch CVE-2026-25926?

Patch guidance is available from notepad-plus-plus security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2026-25926.

Which products are affected by CVE-2026-25926?

1 product: notepad-plus-plus notepad\+\+.

Fix CVE-2026-25926 - HIGH notepad-plus-plus notepad\+\+

Description

Notepad++ is a free and open-source source code editor. An Unsafe Search Path vulnerability (CWE-426) exists in versions prior to 8.9.2 when launching Windows Explorer without an absolute executable path. This may allow execution of a malicious explorer.exe if an attacker can control the process working directory. Under certain conditions, this could lead to arbitrary code execution in the context of the running application. Version 8.9.2 patches the issue.

CVSS Metrics

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack Vector: local
Complexity: low
Privileges: low
User Action: required
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high
Weaknesses: CWE-426

Metadata

Primary Vendor: NOTEPAD-PLUS-PLUS
Published: 2/19/2026
Last Modified: 2/19/2026
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

CVE-2026-25926

Description

CVSS Metrics

Metadata

Affected Products

Remediation Guidance

Executive Summary