The vulnerability allows a local attacker who can place a malicious powershell.exe in a user‑writable custom installation directory to coerce the Notepad++ installer into executing that file with the elevated privileges of the installer itself. Because the installer resolves powershell.exe via the current working directory rather than a full path, the malicious executable can be launched without the user's awareness, granting the attacker full administrative rights on the affected machine. The weakness is classified as CWE-426, Insecure Library or Package Dependency.

Notepad++ versions 8.9.4 and 8.9.5 are affected. The issue is resolved in version 8.9.6, which can be safely installed on systems that previously ran the vulnerable releases.

The CVSS score of 7.5 indicates a high severity with full control of the system as the attacker’s objective. EPSS data is not available, but the vulnerability’s nature means that exploitation is straightforward for an attacker who can influence the installation process on a device with administrative rights. The vulnerability is not currently listed in the CISA KEV catalog, and no public exploits are known, yet the vector requires local presence and privileged installation, a typical scenario in many enterprises. Monitoring user‑ writable installation paths and deploying the public fix are the most effective mitigation strategies.