CVE-2026-77605Published
Notepad++ “Run by system” executes *.txt.cmd when user selected *.txt (target confusion → command execution)
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-77605 · Microsoft / collected KEV context
cve-program · CVE-2026-77605
- https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-w5xq-frjg-w4cw
- https://github.com/notepad-plus-plus/notepad-plus-plus/commit/00fa5df0da1d4f6b334317aa979db13ac77ee24d
- https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.8
- https://notepad-plus-plus.org/news/v898-released
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.