Authenticode Verification Bypass in Notepad++ Updater Allows Modified Code Execution

Notepad++ is a free and open-source source code editor. From 8.9.7 until 8.9.8, the Notepad++ updater and signature verification path can accept a modified GUP.exe file whose embedded certificate metadata remains present even though its Authenticode digest is invalid. An attacker who can replace or plant the updater-related file can cause Notepad++ to launch attacker-modified code when a user triggers the updater path, but the issue does not provide remote code execution by itself. This issue is fixed in version 8.9.8.

• The structured affected boundary in the record is Notepad++ versions < 8.9.8.
• The description and advisory specifically focus on version 8.9.7.
• The supplied record and release materials identify 8.9.8 as the fixed version.
• The GitHub advisory page inspected during research lists 8.9.7 as affected but currently shows no patched version. For triage, use the structured < 8.9.8 boundary and the 8.9.8 fix; the status of later or parallel release branches is not separately established.

The affected component is the Notepad++ updater, also known as WinGUp, and its signed-binary verification path. The verifier can check for certificate metadata yet still accept a modified GUP.exe when its Authenticode digest is invalid. The advisory describes the original updater being accepted, a modified updater retaining certificate metadata being accepted and launched, and an unsigned control executable being rejected. Exploitation requires the attacker to replace or plant an updater-related file where Notepad++ will use it, followed by user interaction to trigger the updater path. The fix commit shows that verification was changed to treat a WinVerifyTrust error as a failure and to enable chain-of-trust checking. The advisory does not establish every way the file could be placed on a system or the complete privilege boundary in every deployment.

The issue is locally reachable, requires low privileges, and requires user interaction to trigger the updater. The attacker must first replace or plant an updater-related file for Notepad++ to use; the issue does not provide remote code execution by itself. The advisory includes a safe, marker-only proof of concept demonstrating acceptance and execution of a modified binary, but that is not evidence of real-world campaign activity. The record marks public_exploit as false and does not identify an exploitation status; those values should not be treated as absolute proof that abuse has never occurred.

Successful exploitation can cause Notepad++ to execute attacker-modified code through a trusted updater path. That code may affect confidentiality, integrity, or availability within the privileges available to the Notepad++ process. The record describes unchanged scope, with local access, low privileges, and user interaction required. The issue does not independently provide remote code execution and does not establish escalation to system privileges. Post-execution access depends on the account and process rights; no specific payload, victim, or breach is established.

Successful exploitation can cause Notepad++ to execute attacker-modified code through a trusted updater path. Possible consequences include access to data, modification of data, or service disruption within the privileges of the updater process. The actual organizational effect depends on the account running Notepad++ and the process rights available in that environment. The available evidence does not establish a specific breach, victim, campaign, or privilege-escalation scenario.

1. Upgrade Notepad++ to exactly version 8.9.8, which the record identifies as fixing the issue. Do not infer that every later release branch has been separately verified from this evidence.
2. Inventory and remediate installations within the < 8.9.8 range, including systems where WinGUp or GUP.exe is deployed.
3. If immediate upgrade is not possible, restrict write access to updater-related files and directories, and avoid triggering the updater on systems where an attacker may be able to replace those files. This is a general precaution, not a vendor-confirmed workaround.
4. Validate binaries with full Authenticode verification, including the file digest, signature validity, and chain of trust. Do not rely only on certificate metadata.
5. After updating, recheck the installed version and review unexpected changes to GUP.exe or other updater artifacts.

1. Inventory Notepad++ installations and flag versions below 8.9.8 for remediation.
2. Identify the presence and location of GUP.exe, WinGUp, and related updater artifacts.
3. Use full Authenticode validation to check both the file digest and the chain of trust; the presence of certificate metadata alone is insufficient.
4. Review file-integrity telemetry and execution records around Notepad++ updater invocations, especially unexpected changes to or execution of GUP.exe. This is precautionary monitoring, not a confirmed IOC.
5. Treat the absence of suspicious events as insufficient to prove that a system is safe.