Notepad++ Zero-Click Remote Code Execution Vulnerability Discovered in Latest Version

A zero-click remote code execution vulnerability has been identified in Notepad++ version 8.9.6.1, the latest patched release. The vulnerability (CVE-2026-52884) exploits a path traversal flaw in the isInTrustedDirectory() validation function introduced in a previous security patch (CVE-2026-48800). The function uses a prefix-based check without canonicalizing paths first, allowing attackers to bypass security checks by embedding directory traversal sequences (..\) within trusted directory paths. For example, a path like C:\Windows\System32\..\..\Users\[USERNAME]\Downloads\mimikatz.exe passes validation because it starts with the trusted C:\Windows\System32\ prefix, but resolves to an untrusted location. The vulnerability can be exploited through multiple vectors, including direct modification of the shortcuts.xml configuration file or via malicious .lnk files that redirect Notepad++ to load configuration from attacker-controlled locations. The recommended fix involves canonicalizing paths using functions like PathCanonicalize() or GetFullPathNameW() before performing the trusted directory check.