Notepad++ Fixes Hijacked Update Mechanism Used to Deliver Targeted Malware
Notepad++ Patch Fixes Hijacked Update Mechanism Used to Deliver Targeted Malware
Notepad++ has released a security update to address vulnerabilities that were exploited by a sophisticated threat actor from China to compromise the software’s update mechanism and deliver malware to specific targets.
Security Update and Fixes
The update, version 8.9.2, incorporates a “double lock” design aimed at making the update process more robust and resistant to exploitation.
The security fix includes enhancements to the WinGUp auto-updater component, such as the removal of libcurl.dll to prevent DLL side-loading attacks, and the elimination of two unsecured cURL SSL options. Additionally, the update restricts plugin management execution to programs signed with the same certificate as WinGUp.
Vulnerability and Exploitation
The update also addresses a high-severity vulnerability (CVE-2026-25926, CVSS score: 7.3) that could lead to arbitrary code execution in the context of the running application.
Previous Breach and Attribution
The vulnerability was discovered weeks after Notepad++ disclosed a breach at the hosting provider level, which allowed threat actors to hijack update traffic starting in June 2025.
The attackers redirected requests from certain users to malicious servers, serving a poisoned update. The issue was detected in early December 2025.
Recommendation
The Notepad++ update aims to prevent similar attacks by ensuring the integrity of the update process. Users are advised to apply the update to prevent potential exploitation.
About Author
English