CVE-2026-71858: 
Notepad++ vulnerability analysis and mitigation

CVE-2026-71858 is a shortcuts.xml macro HMAC bypass vulnerability in Notepad++ that allows a local attacker to achieve conditional elevated command execution. The flaw affects all Notepad++ versions prior to 8.9.7 (specifically confirmed in v8.9.6.4) and was disclosed on July 14, 2026, with a fix released the same day. It carries a CVSS v4.0 base score of 5.4 (Medium) (GitHub Advisory, Feedly).

The root cause is that Notepad++'s HMAC integrity validation applied to shortcuts.xml was enforced for UserDefinedCommands but not for Macros (CWE-345, CWE-693, CWE-78). An attacker who can influence the settingsDir consumed by an elevated Notepad++ process can place a malicious shortcuts.xml containing crafted macros that invoke Scintilla actions and the internal "Open in Default Viewer" command without triggering HMAC/tampering validation. The fix (commit 7686e5a) extends the HMAC security validation block to cover both macro (ID_MACRO) and user command (ID_USER_CMD) code paths before execution (GitHub Advisory, Fix Commit).

Successful exploitation allows a low-privileged local attacker to modify protected files under C:\Program Files\Notepad++ and execute commands in the context of an elevated Notepad++ process, effectively achieving privilege escalation under specific conditions. The confidentiality, integrity, and availability of the affected system are all rated HIGH in the CVSS v4.0 assessment, as an attacker can read sensitive data, tamper with protected system files, and potentially disrupt service. The attack is conditional — it requires the attacker to control the settingsDir path and a user to trigger the macro in an elevated session (GitHub Advisory).

A proof-of-concept (PoC) was prepared by the reporters (Enrique de Clerck and Jean Hurtado Milian) and submitted alongside the advisory, demonstrating protected file modification and elevated command execution via whoami /priv and whoami /groups output. The NVD SSVC assessment classifies exploitation status as "poc" and technical impact as "total," though the attack is not automatable. The EPSS score is approximately 0.099%, indicating low probability of widespread exploitation in the near term. There is no evidence of in-the-wild exploitation or CISA KEV catalog listing at this time (GitHub Advisory, Feedly).

1. Establish local access: Obtain a low-privileged local account on a Windows system where Notepad++ is installed and used in an elevated (administrator) context.
2. Identify settingsDir: Determine or influence the settingsDir path consumed by the elevated Notepad++ process — this is the directory from which shortcuts.xml is loaded.
3. Craft malicious shortcuts.xml: Create a shortcuts.xml file containing attacker-controlled macros that invoke Scintilla actions and/or the internal "Open in Default Viewer" command on an attacker-controlled .cmd file. Because HMAC validation was not applied to macros, this file will pass integrity checks.
4. Place the file: Write the malicious shortcuts.xml to the settingsDir path accessible to the elevated Notepad++ process.
5. Wait for user trigger: Wait for a user to trigger the macro in the elevated Notepad++ session (e.g., via a keyboard shortcut or menu action mapped in the malicious shortcuts.xml).
6. Achieve elevated execution: The macro invokes the "Open in Default Viewer" command on the attacker's .cmd file, executing it in the elevated Notepad++ context, enabling protected file modification or arbitrary command execution with elevated privileges (GitHub Advisory).

• File System: Unexpected or recently modified shortcuts.xml in the Notepad++ settings directory (e.g., %AppData%\Notepad++\shortcuts.xml or a custom settingsDir); presence of attacker-controlled .cmd or script files in directories accessible to the Notepad++ process; new or modified files under C:\Program Files\Notepad++ created by a non-administrator account.
• Process: Unusual child processes spawned by notepad++.exe running as an elevated user (e.g., cmd.exe, powershell.exe, or other shells); execution of .cmd files via the default viewer from within an elevated Notepad++ session.
• Logs: Windows Security Event Log entries showing process creation (Event ID 4688) with notepad++.exe as the parent and unexpected child processes; file write events to C:\Program Files\Notepad++ from a low-privileged account context.

Upgrade Notepad++ to version 8.9.7 or later, which extends HMAC validation to cover macros in addition to UserDefinedCommands (v8.9.7 Release). As a workaround, restrict write access to the settingsDir used by elevated Notepad++ processes so that low-privileged users cannot place or modify shortcuts.xml. Avoid running Notepad++ with elevated privileges unless strictly necessary, and audit the contents of shortcuts.xml for unexpected macro entries.

The vulnerability was reported by security researchers Enrique de Clerck and Jean Hurtado Milian, who provided a detailed PoC package including a video, scripts, and a Markdown technical report. The Notepad++ maintainer (donho) published the advisory and released the patch on the same day (July 14, 2026), demonstrating a rapid response. The release of v8.9.7 received positive community reactions on GitHub, with 60 users reacting to the release (GitHub Advisory, v8.9.7 Release).