Notepad++ Zero-Click RCE via Path Traversal (CVE-2026-52884)
Summary
CVE-2026-52884 describes a zero-click remote code execution vulnerability in Notepad++ via path traversal, affecting users on Windows.
View Cached Full Text
Cached at: 06/10/26, 11:43 AM
notepad-plus-plus/notepad-plus-plus
Source: https://github.com/notepad-plus-plus/notepad-plus-plus
What is Notepad++ ?
Notepad++ is a free (free as in both “free speech” and “free beer”) source code editor and Notepad replacement that supports several programming languages and natural languages. Running in the MS Windows environment, its use is governed by GPL License.
See the Notepad++ official site for more information.
Notepad++ GPG Release Key
Since the release of version 7.6.5 Notepad++ is signed using GPG with the following key:
- Signer: Notepad++
- E-mail: [email protected]
- Key ID: 0x8D84F46E
- Key fingerprint: 14BC E436 2749 B2B5 1F8C 7122 6C42 9F1D 8D84 F46E
- Key type: RSA 4096/4096
- Created: 2019-03-11
- Expires: 2027-03-13
https://github.com/notepad-plus-plus/notepad-plus-plus/blob/master/nppGpgPub.asc
Supported OS
All the Windows systems still supported by Microsoft are supported by Notepad++. However, not all Notepad++ users can or want to use the newest system. Here is the Supported systems information you may need in case you are one of them.
Build Notepad++
Please follow build guide to build Notepad++ from source.
Contribution
Contributions are welcome. Be mindful of our Contribution Rules to increase the likelihood of your contribution getting accepted.
Similar Articles
CVE-2026-46529: 10-year-old RCE in Linux PDF Viewer (XReader/Evince/Atril)
A security researcher discovered CVE-2026-46529, a 10-year-old remote code execution vulnerability in Linux PDF viewers XReader, Evince, and Atril, caused by insufficient argument quoting when spawning child processes to open remote document links.
CVE-2026-40369: Arbitrary Kernel Address Increment via NtQuerySystemInformation
CVE-2026-40369 describes a vulnerability in Windows kernel's NtQuerySystemInformation function that allows arbitrary kernel address increment, enabling privilege escalation from unprivileged processes including Chrome sandbox. The exploit is deterministic on Windows 11 24H2-25H2.
CVE-2026-33696: From a Schema Name to RCE in n8n
This CVE describes a prototype pollution vulnerability in n8n that can be exploited for remote code execution through a Git node gadget chain.
Dark Elevator: Windows Install Service Local Privilege Escalation (CVE-2026-50343)
A blog post detailing a local privilege escalation vulnerability (CVE-2026-50343) in the Windows Install Service on Windows 11, allowing a standard user to execute code as SYSTEM by exploiting a writable plugin map and a user-plantable COM server.
Reporting a 19+ Years Hidden Linux Kernel Zero-Day for Google kernelCTF: CVE-2026-43456
A Linux kernel zero-day vulnerability (CVE-2026-43456) rooted in code from 2007 was discovered by Yuki Koike and Kota Toda, rewarded over $80,000 via Google's kernelCTF. The flaw, a type confusion in the net/bonding subsystem, allows reliable privilege escalation within one second.