Notepad++ Custom Settings Directory via Command Line (CVE-2026-48778)

Ethan Andrews@eandrews

•updated May 28, 2026•2•0•13

Detects the execution of Notepad++ using the '-settingsDir=' argument, which can be used to redirect the application to load attacker-controlled configuration files, potentially exploiting vulnerabilities like CVE-2026-48778. This technique could allow an adversary to achieve persistence or execute malicious code by manipulating Notepad++'s configuration.