CVE-2026-52885

What it actually does

CVE-2026-52885 is a local time-of-check/time-of-use race condition in Notepad++ versions prior to 8.9.6.4. The application validates the HMAC of the on-disk shortcuts.xml file when a user command is executed, but the actual command payload is loaded earlier from the in-memory _userCommands vector at application startup and is not re-synchronized with the file being validated. If an attacker can write to shortcuts.xml before Notepad++ launches, they can cause Notepad++ to load a malicious user command into memory, restore a legitimate shortcuts.xml file before execution, and have the HMAC validation pass while the malicious in-memory command executes. The technical result is local arbitrary command execution in the context of the Notepad++ user.

Why it matters to the business

Successful exploitation can let a local attacker run commands as the user who opens Notepad++, potentially leading to workstation compromise, credential theft, persistence, or tampering with files accessible to that user. The vulnerability requires local file-write opportunity and precise timing, has low EPSS, is not currently listed in CISA KEV, and has no known public exploit maturity indicated, so broad internet-scale exploitation is unlikely; however, it is still important in environments where Notepad++ is widely installed on developer, administrator, or privileged user workstations.

How an attack unfolds

An attacker first obtains the ability to modify the Notepad++ shortcuts.xml configuration file used by a target user, such as through local access, a compromised user profile, malware already running with sufficient permissions, or another weakness that allows writing to the user’s Notepad++ configuration directory. Before Notepad++ starts, the attacker places a malicious shortcuts.xml containing a user command that launches an attacker-chosen payload or system command. When Notepad++ launches, it loads that malicious command into its in-memory _userCommands vector. The attacker then quickly restores the original legitimate shortcuts.xml on disk. Later, when the user command fires, Notepad++ checks the HMAC of the restored clean file, sees it as valid, and proceeds to execute the command payload that remains in memory from the earlier malicious file. This results in code or command execution as the Notepad++ user while evading the intended integrity check.

How to fix it

Upgrade Notepad++ to version 8.9.6.4 or later. If centralized software management is used, prioritize deployment to workstations used by developers, administrators, help desk staff, and other users with elevated access. As interim risk reduction, restrict write access to Notepad++ configuration files, monitor or block unauthorized modification of shortcuts.xml, limit execution of untrusted scripts and binaries from user-writable directories, and use endpoint controls to prevent suspicious child processes launched by Notepad++. Remove or review unexpected Notepad++ user-defined commands and validate that configuration files have not been tampered with.

How to confirm the fix worked

Confirm that installed Notepad++ versions are 8.9.6.4 or newer. On Windows, validate through the Notepad++ Help > About dialog, package inventory, installed application records, or by checking the version metadata for notepad++.exe. Review user profile Notepad++ configuration directories for shortcuts.xml and confirm the file does not contain unexpected Run commands, script interpreters, PowerShell, cmd.exe, mshta.exe, wscript.exe, cscript.exe, rundll32.exe, regsvr32.exe, curl, certutil, or references to user-writable payload paths. Test endpoint detections by verifying that Notepad++ spawning command interpreters or scripting hosts generates an alert. Where feasible, compare shortcuts.xml against a known-good baseline and review file modification timestamps around Notepad++ launch times.

Typical attack path

1. Gain local ability to write to the target user’s Notepad++ shortcuts.xml file.
2. Replace shortcuts.xml with a malicious version containing an attacker-controlled user command.
3. Wait for or induce Notepad++ to launch so the malicious command is loaded into memory.
4. Restore the legitimate shortcuts.xml file on disk before command execution.
5. Trigger or wait for the affected user command to execute.
6. Notepad++ validates the clean on-disk shortcuts.xml HMAC while executing the malicious in-memory command payload.
7. Use the resulting user-context command execution for follow-on actions such as payload launch, persistence, credential access, or lateral movement.

How to detect it

To determine whether exploitation already occurred, focus on endpoint telemetry, process creation logs, file modification records, and Notepad++ configuration artifacts. Review Windows Security Event ID 4688, Sysmon Event ID 1 process creation, Sysmon Event ID 11 file creation, Sysmon Event ID 15 file stream creation, Sysmon Event ID 22 DNS queries, EDR process trees, PowerShell logs, and file integrity monitoring around Notepad++ launch and user command execution times. Look for notepad++.exe spawning command interpreters, scripting hosts, LOLBins, download utilities, archive tools, or unknown executables. Examine shortcuts.xml modification timestamps and contents for rapid replace/restore behavior, unexpected commands, encoded payloads, suspicious paths, or network retrieval commands. Correlate any Notepad++ child process with subsequent network connections, dropped files, scheduled task creation, registry Run key changes, credential-access tooling, or persistence activity. There are no public threat actors or ransomware campaigns associated with this vulnerability in the provided data, so detection should be behavior-based rather than actor-specific.

• notepad++.exe -> cmd.exe
• notepad++.exe -> powershell.exe
• notepad++.exe -> pwsh.exe
• notepad++.exe -> wscript.exe
• notepad++.exe -> cscript.exe
• notepad++.exe -> mshta.exe
• notepad++.exe -> rundll32.exe
• notepad++.exe -> regsvr32.exe
• notepad++.exe -> certutil.exe
• notepad++.exe -> curl.exe
• notepad++.exe -> bitsadmin.exe
• notepad++.exe -> schtasks.exe
• notepad++.exe -> reg.exe
• %APPDATA%\Notepad++\shortcuts.xml
• %PROGRAMFILES%\Notepad++\notepad++.exe
• %PROGRAMFILES(X86)%\Notepad++\notepad++.exe
• shortcuts.xml
• <UserDefinedCommands>
• <Command
• powershell -enc
• powershell -EncodedCommand
• cmd /c
• mshta http
• certutil -urlcache
• bitsadmin /transfer
• schtasks /Create
• HKCU\Software\Microsoft\Windows\CurrentVersion\Run

What your security team should do

• Patch Notepad++ to 8.9.6.4 or later across managed endpoints, prioritizing privileged and developer workstations.
• Inventory systems running Notepad++ versions prior to 8.9.6.4 and track remediation to completion.
• Hunt for suspicious Notepad++ child processes, especially command shells, scripting engines, living-off-the-land binaries, and network utilities.
• Review shortcuts.xml files for unexpected user commands, encoded commands, external script execution, or references to suspicious paths.
• Deploy or tune EDR/SIEM detections for notepad++.exe spawning cmd.exe, powershell.exe, pwsh.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, curl.exe, or unknown executables in user-writable directories.
• Restrict modification of application configuration files where operationally feasible and apply least-privilege controls to user profiles and shared workstations.
• Because this is not currently in CISA KEV, has no known exploit maturity, and has low EPSS, treat it as a prioritized endpoint hardening and patch-management issue rather than an emergency internet-facing exposure.