Notepad++ performs a time‑of‑check by verifying the HMAC of the shortcuts.xml file at the moment a user command is fired, but the command payload is taken from an in‑memory vector that is never refreshed. An attacker who can temporarily replace shortcuts.xml with a malicious version before the command runs can cause the HMAC check to validate the legitimate file after it is restored, while the malicious command remains in memory and is executed. This flaw allows the attacker to run arbitrary local commands with the privileges of the Notepad++ process.

Versions of Notepad++ before 8.9.6.4 are affected, as the vulnerability is fixed in 8.9.6.4. The flaw exists in the Windows build of the application.

The CVSS score of 7.5 indicates a high‑severity vulnerability. Because EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, the probability of immediate exploitation is not quantified, but the attack can be performed if an attacker can write to shortcuts.xml and then launch Notepad++. A file‑system race is required, so denial of service or other side effects are not directly feasible, but local code execution with the user’s privileges can occur if successful.