Sploitus

26 exploited vulnerabilities in Notepad++

Vulnerabilities with publicly known exploits

Vendors
Notepad++ Team, Notepad++, Don Ho, Scintilla, Tabnine
With known exploits
26
Affected Don Ho Notepad\+\+ versions
= 6.6.9
Affected Notepad-plus-plus Notepad\+\+ versions
< 8.9.6.1, 7.7, 8.9.6.4, 8.1
Affected Notepad\+\+ versions
≤ 4.1.1
Affected Scintilla versions
= 1.73

Vulnerabilities with exploits

Highest CVSS first — 10 of these already have exploit code on Sploitus

CVE-2014-9456 1 exploit
CVSS 10.0 HIGH 2015-01-02FIX AVAILABLE
Notepad++ 6.6.9 - Buffer Overflow
CVE-2025-56383
CVSS 8.4 HIGH 2025-09-26FIX AVAILABLE
CVE-2026-46710
CVSS 7.8 HIGH 2026-06-26FIX AVAILABLE
CVE-2026-52884
CVSS 7.8 HIGH 2026-05-30
CVE-2026-48800 2 exploits
CVSS 7.8 HIGH 2026-05-26
Exploit for CVE-2026-48800Notepad-8.9.6-PoC
CVE-2026-48778 4 exploits
CVSS 7.8 HIGH 2026-05-26FIX AVAILABLE
📄 Notepad++ 8.9.6 Arbitrary Code ExecutionNotepad++ 8.9.6 - Arbitrary Code Execution
CVE-2026-5525
CVSS 7.8 HIGH 2026-04-10FIX AVAILABLE
CVE-2023-47452
CVSS 7.8 HIGH 2023-11-30
CVE-2023-40031
CVSS 7.8 HIGH 2023-08-21FIX AVAILABLE
CVE-2019-16294 1 exploit
CVSS 7.8 HIGH 2019-09-14FIX AVAILABLE
Notepad++ < 7.7 (x64) - Denial of Service
CVE-2017-8803
CVSS 7.8 HIGH 2017-07-05FIX AVAILABLE
CVE-2025-15556
CVSS 7.7 HIGH 2025-12-09FIX AVAILABLE
CVE-2007-2666 1 exploit
CVSS 7.6 HIGH 2007-05-14FIX AVAILABLE
Notepad++ 4.1 (Windows x86) - '.ruby' File Processing Buffer Overflow
CVE-2026-52885 1 exploit
CVSS 7.5 HIGH 2026-06-26FIX AVAILABLE
Exploit for CVE-2026-52885
CVE-2026-25926
CVSS 7.3 HIGH 2026-02-16FIX AVAILABLE
CVE-2025-49144 4 exploits
CVSS 7.3 HIGH 2025-06-21FIX AVAILABLE
Exploit for CVE-2025-49144Exploit for CVE-2025-49144
CVE-2026-49144
CVSS 7.1 HIGH 2026-02-03
CVE-2026-3008 1 exploit
CVSS 6.6 MEDIUM 2026-04-27FIX AVAILABLE
Exploit for CVE-2026-3008
CVE-2022-31901
CVSS 6.5 MEDIUM 2023-01-19
CVE-2022-31902
CVSS 5.5 MEDIUM 2023-02-01
CVE-2023-40036
CVSS 5.5 MEDIUM 2023-08-25FIX AVAILABLE
CVE-2023-40166
CVSS 5.5 MEDIUM 2023-08-21FIX AVAILABLE
CVE-2023-40164
CVSS 5.5 MEDIUM 2023-08-21FIX AVAILABLE
CVE-2023-6401 1 exploit
CVSS 5.3 MEDIUM 2023-11-30FIX AVAILABLE
Exploit for Uncontrolled Search Path Element in Notepad-Plus-Plus Notepad\+\+
CVE-2026-48770 1 exploit
CVSS 5.0 MEDIUM 2026-05-26FIX AVAILABLE
Notepad-8.9.6-PoC
CVE-2026-6539
CVSS 4.6 MEDIUM 2026-04-30FIX AVAILABLE