Description
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortcuts.xml HMAC validation because WM_MACRODLGRUNMACRO, the Run a Macro Multiple Times entry point, calls macroPlayback() without the validation used by command(). A tampered shortcuts.xml macro that is blocked through the Macro menu or a shortcut key can therefore execute through the multi-run dialog and invoke internal Notepad++ commands, including commands that launch external programs, in the current user context. This issue is fixed in version 8.9.8.
Published: 2026-09-22
Score: 6.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The flaw arises from incomplete HMAC validation on shortcuts.xml files when triggered through the Run a Macro Multiple Times dialog. A crafted macro that would normally be rejected by other menu paths can bypass the check, invoking internal commands that can launch external applications. This bypass enables an attacker to execute arbitrary code in the current user context.

Affected Systems

Notepad++ before version 8.9.8. The vulnerability exists in all builds released earlier than the patch in v8.9.8.

Risk and Exploitability

The CVSS score of 6.7 indicates moderate severity. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog, suggesting it has not yet been actively exploited. Attackers would need local access to the system to alter shortcuts.xml, so the exposure is limited to machines that have the editor installed and are not protected by strict file permissions.

Generated by OpenCVE AI on September 22, 2026 at 19:48 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official Notepad++ 8.9.8 or newer update, which restores full HMAC validation and fixes the CWE-345, CWE-693, and CWE-78 weaknesses.
  • If an upgrade is not immediately possible, disable write access to shortcuts.xml and block the Run a Macro Multiple Times dialog to prevent exploitation of the HMAC validation bypass (CWE-345) and command execution vulnerability (CWE-78).
  • Implement monitoring or policy to restrict external program execution from within Notepad++ to mitigate the risk of OS command injection (CWE-78) and unintended resource usage (CWE-693).

Generated by OpenCVE AI on September 22, 2026 at 19:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 26 Sep 2026 00:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 22 Sep 2026 19:15:00 +0000

Type Values Removed Values Added
First Time appeared Notepad-plus-plus
Notepad-plus-plus notepad++
Vendors & Products Notepad-plus-plus
Notepad-plus-plus notepad++

Tue, 22 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortcuts.xml HMAC validation because WM_MACRODLGRUNMACRO, the Run a Macro Multiple Times entry point, calls macroPlayback() without the validation used by command(). A tampered shortcuts.xml macro that is blocked through the Macro menu or a shortcut key can therefore execute through the multi-run dialog and invoke internal Notepad++ commands, including commands that launch external programs, in the current user context. This issue is fixed in version 8.9.8.
Title Notepad++: Shortcuts.xml macro HMAC bypass still reachable via the "Run a Macro Multiple Times" dialog
Weaknesses CWE-345
CWE-693
CWE-78
References
Metrics cvssV3_1

{'score': 6.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Notepad-plus-plus Notepad++
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-25T23:48:00.716Z

Reserved: 2026-09-03T16:37:49.262Z

Link: CVE-2026-85288

cve-icon Vulnrichment

Updated: 2026-09-25T23:47:56.501Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-22T18:17:23.373

Modified: 2026-09-26T00:16:37.387

Link: CVE-2026-85288

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T20:00:13Z

Weaknesses
  • CWE-345

    Insufficient Verification of Data Authenticity

  • CWE-693

    Protection Mechanism Failure

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')