This vulnerability allows a local attacker to place a crafted shortcuts.xml file in Notepad++'s settings directory. The file bypasses the HMAC validation that normally protects UserDefinedCommands, enabling the attacker to trigger Scintilla actions and to invoke the internal 'Open in Default Viewer' command while Notepad++ runs with elevated privileges. As a result, the attacker can modify protected files and execute arbitrary commands when a user opens the malicious macro.

Notepad++ versions prior to 8.9.7 are affected. The vulnerability exists in every release before that point, regardless of sub‑minor version, and can be exploited on any platform where the application is installed.

The CVSS score of 5.4 reflects a medium severity. Since the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the immediate threat level is moderate. Exploitation requires the attacker to supply a malicious shortcuts.xml file and for a user to load that file as a macro, so the attack vector is local and user‑initiated. Once the macro is executed, the attacker may gain elevated command execution with the privileges of the Notepad++ process.