CVE-2026-73250
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A vulnerability in the Notepad++ installer for Windows 11 x64 and ARM64 prior to 8.9.7 allows PowerShell command execution in the installer's security context via subexpression syntax in the installation path when the context menu component is selected.
Risk Assessment
An attacker can influence the installation path, potentially leading to arbitrary code execution during installation, possibly taking control of the system.
Recommendation
Update Notepad++ to version 8.9.7 or later. During installation, use trusted paths and avoid selecting the context menu component if not needed.
Original NVD description (English source)
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the Notepad++ Windows 11 x64 and ARM64 installer passes the attacker-influenced installation directory `$INSTDIR` from PowerEditor/installer/nppSetup.nsi into a PowerShell `-Command` string used by RegisterMSIX to invoke Add-AppxPackage, allowing PowerShell subexpression syntax such as `$()` in the installation path to execute commands in the installer's security context when the context menu component is selected. This issue is fixed in version 8.9.7.