CVE-2026-52885: 
Notepad++ vulnerability analysis and mitigation

CVE-2026-52885 is a Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability in Notepad++ that allows a local attacker to execute arbitrary commands by exploiting a desynchronization between the on-disk HMAC validation and the in-memory command payload. All versions of Notepad++ prior to 8.9.6.4 are affected. The vulnerability was published on June 26, 2026, and fixed in version 8.9.6.4. It carries a CVSS v3.1 base score of 6.3 (Medium) and a CVSS v4.0 base score of 7.5 (High) (GitHub Advisory, Feedly).

The root cause is a CWE-367 (Time-of-Check Time-of-Use Race Condition) in NppCommands.cpp. At command execution time, Notepad++ computes the HMAC of the on-disk shortcuts.xml and compares it against the stored value in config.xml (the check); however, the actual command payload is sourced from the in-memory _userCommands vector, which is populated at application startup and never re-synchronized with the on-disk file (the use). An attacker with write access to shortcuts.xml can place a malicious version on disk before Notepad++ launches — causing the malicious commands to be loaded into memory — then immediately restore the legitimate file before the HMAC check fires at command execution. The check validates the clean, restored file and passes, while the malicious payload from memory executes. The fix (commit 4f7563c) resolves this by computing and storing the HMAC of shortcuts.xml at startup into a new _shortcutsOnDiskHmac field, so the check at execution time compares startup-time disk state rather than re-reading the file (GitHub Advisory, Patch Commit).

Successful exploitation allows a local attacker with write access to shortcuts.xml to execute arbitrary commands under the privileges of the user running Notepad++, achieving high integrity and availability impact. Confidentiality impact is rated None under CVSS v3.1, though arbitrary command execution could be chained to access sensitive data or escalate privileges. The attack is constrained to local access and requires the attacker to already have write permissions to the Notepad++ configuration directory, limiting its scope to scenarios such as shared systems, compromised accounts, or malicious software already present on the host (GitHub Advisory, Feedly).

1. Precondition: Obtain write access to the Notepad++ configuration directory (e.g., C:\Users\<user>\AppData\Roaming\Notepad++\ or a portable install directory). Ensure config.xml contains a valid HMAC for the legitimate shortcuts.xml.
2. Craft malicious shortcuts.xml: Create a modified shortcuts.xml containing a malicious user command payload (e.g., a command that launches calc.exe or a reverse shell) in the _userCommands section.
3. Overwrite shortcuts.xml: Replace the legitimate shortcuts.xml on disk with the malicious version before launching Notepad++.
4. Launch Notepad++: Start the Notepad++ process (notepad++.exe). During startup, the application reads shortcuts.xml from disk and loads the malicious _userCommands vector into memory.
5. Restore legitimate file: Immediately after Notepad++ starts (before any user command fires), restore the original legitimate shortcuts.xml to disk, so the HMAC check will validate the clean file.
6. Trigger the user command: Send a Windows message to the Notepad++ window handle to trigger the user command: SendMessage(hwnd, WM_COMMAND, 21000, 0) (corresponding to ID_USER_CMD + 0).
7. HMAC check passes: NppCommands.cpp reads the now-restored legitimate shortcuts.xml from disk, computes its HMAC, and finds it matches the stored value — the check passes.
8. Malicious payload executes: The command execution reads _userCommands[0] from the in-memory vector (still containing the malicious payload loaded at startup) and executes it.
9. Verify execution: Confirm arbitrary command execution (e.g., calc.exe spawned with PID 35932 as demonstrated in the PoC) (GitHub Advisory, PoC Repository).

• File System: Unexpected modifications to shortcuts.xml in the Notepad++ configuration directory (e.g., %APPDATA%\Notepad++\shortcuts.xml or portable install path) followed by rapid restoration to the original file; presence of poc_8962_toctou.ps1 or similar scripts on disk.
• Process: Unexpected child processes spawned by notepad++.exe (e.g., calc.exe, cmd.exe, powershell.exe, or network tools like curl.exe) that are not consistent with normal editor usage.
• Logs: Windows Security Event Log entries showing file write operations to shortcuts.xml immediately before Notepad++ process creation, followed by another write shortly after; PowerShell script block logging events referencing TOCTOU or shortcuts.xml manipulation.
• Network: Outbound connections from notepad++.exe to unexpected external hosts, which may indicate a reverse shell payload was used instead of a benign PoC command (GitHub Advisory, PoC Repository).

Update Notepad++ to version 8.9.6.4 or later, which resolves the TOCTOU issue by computing and caching the HMAC of shortcuts.xml at application startup rather than re-reading the file at command execution time (Patch Commit). As a workaround prior to patching, restrict write access to the shortcuts.xml file and its parent directory to prevent unauthorized modification. Additionally, monitor shortcuts.xml for unexpected changes using file integrity monitoring tools (GitHub Advisory).

The vulnerability was published by Notepad++ maintainer donho via a GitHub Security Advisory on June 4, 2026, and credited to researcher v3s9er (RAGE) who also published the PoC exploit. The advisory was picked up by standard CVE tracking feeds and aggregators shortly after disclosure. No significant broader media coverage or notable researcher commentary beyond the original advisory and PoC publication has been identified (GitHub Advisory, PoC Repository).