CVE-2026-85288: 
Notepad++ vulnerability analysis and mitigation

CVE-2026-85288 is a shortcuts.xml HMAC validation bypass vulnerability in Notepad++ that allows a local attacker to execute arbitrary internal commands — including launching external programs — by exploiting an incomplete security fix. Specifically, the WM_MACRODLGRUNMACRO handler (the "Run a Macro Multiple Times" dialog entry point) calls macroPlayback() without the HMAC integrity check applied by the command() dispatcher, meaning a tampered macro blocked via the Macro menu can still execute through the multi-run dialog. All Notepad++ versions prior to 8.9.8 are affected. The vulnerability was disclosed on August 24, 2026, and fixed in version 8.9.8 released the same day. It carries a CVSS v3.1 base score of 6.7 (Medium) (GitHub Advisory).

The root cause is an incomplete protection mechanism failure (CWE-693) combined with insufficient verification of data authenticity (CWE-345) and OS command injection risk (CWE-78). Notepad++ 8.9.7 introduced HMAC validation for shortcuts.xml macros in the Notepad_plus::command() dispatcher (NppCommands.cpp), gating the ID_MACRO path so tampered macros are blocked with a warning. However, the WM_MACRODLGRUNMACRO case in NppBigSwitch.cpp — triggered by the "Run a Macro Multiple Times" dialog — retrieves the macro from the MacroShortcut vector and calls macroPlayback() directly, with no HMAC check. Since macroPlayback() itself contains no integrity validation, any caller outside the command() dispatch path bypasses the control entirely. An attacker who can write to the Notepad++ settings directory can craft a malicious shortcuts.xml containing a macro with type='2' and wParam='41020' (IDM_FILE_OPEN_CMD) to launch cmd.exe or invoke other internal commands (GitHub Advisory, Fix Commit).

Successful exploitation allows a local low-privileged attacker to execute arbitrary commands in the current user's context by invoking internal Notepad++ commands such as IDM_FILE_OPEN_CMD (launching cmd.exe) or IDM_FILE_OPEN_DEFAULT_VIEWER (triggering ShellExecute on an attacker-controlled file). This results in high confidentiality, integrity, and availability impact within the scope of the current user session. While the attack is local and requires user interaction, it can serve as a foothold for privilege escalation or lateral movement if chained with other techniques (GitHub Advisory).

A public proof-of-concept (PoC) is available in the GitHub Security Advisory, including a complete automated PowerShell script (npp_macro_hmac_incompletefix_poc.ps1.txt) and a step-by-step reproduction guide with a malicious shortcuts.xml payload. The exploit requires local write access to the Notepad++ settings directory, a file open in Notepad++, and user interaction to open the "Run a Macro Multiple Times" dialog. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.0012 (low probability of exploitation in the near term) (GitHub Advisory).

1. Prepare a malicious settings directory: Create or obtain a fresh Notepad++ settings directory so that config.xml is initialized with the trusted HMAC of the original shortcuts.xml.
2. Craft the malicious shortcuts.xml: Overwrite shortcuts.xml in the settings directory with an XML payload containing a macro definition using type='2', message='0', and wParam='41020' (IDM_FILE_OPEN_CMD), which instructs Notepad++ to launch cmd.exe. This causes the on-disk HMAC to mismatch the value stored in config.xml.
3. Launch Notepad++ with the attacker-controlled settings: Use the -settingsDir flag to point Notepad++ to the compromised settings directory, and open any file so that IDM_FILE_OPEN_CMD is enabled.
4. Verify the Macro menu path is blocked: Attempt to invoke the macro via the Macro menu or a shortcut key — this triggers the command() dispatcher, which detects the HMAC mismatch and displays a "shortcuts.xml appears to have been modified" warning without executing the macro.
5. Trigger the bypass via the multi-run dialog: Open the "Run a Macro Multiple Times" dialog (IDM_MACRO_RUNMULTIMACRODLG) from the Macro menu, select the tampered macro, and click Run.
6. Achieve code execution: The WM_MACRODLGRUNMACRO handler in NppBigSwitch.cpp retrieves the macro and calls macroPlayback() without any HMAC check, executing the macro and launching cmd.exe in the current user context with no integrity warning (GitHub Advisory).

• File System: Unexpected or recently modified shortcuts.xml in the Notepad++ settings directory (e.g., %APPDATA%\Notepad++\shortcuts.xml); presence of macro entries with type='2' and wParam values corresponding to internal commands like 41020 (IDM_FILE_OPEN_CMD) or 41021 (IDM_FILE_OPEN_DEFAULT_VIEWER); presence of npp_macro_hmac_incompletefix_poc.ps1.txt or similar PoC scripts on disk.
• Process: Unexpected cmd.exe or shell processes spawned as child processes of notepad++.exe; ShellExecute-triggered processes (e.g., default file viewers, folder explorer) launched from Notepad++.
• Logs: Windows Event Logs (Security/Application) showing process creation events (Event ID 4688) with notepad++.exe as the parent and cmd.exe or other shells as children; PowerShell script block logging entries related to PoC automation scripts (GitHub Advisory).

Upgrade Notepad++ to version 8.9.8 or later, which extends the HMAC validation to the WM_MACRODLGRUNMACRO handler in NppBigSwitch.cpp, ensuring all macro-playback entry points are protected (v8.9.8 Release, Fix Commit). As a workaround until patching is possible, restrict filesystem write access to the Notepad++ settings directory (%APPDATA%\Notepad++\shortcuts.xml) to prevent unauthorized modification. Additionally, monitor shortcuts.xml for unexpected changes using file integrity monitoring tools.

The vulnerability was discovered and reported by Hung Bach Ngoc from VinSOC Labs (@tomchuoi), credited in the official GitHub Security Advisory. The advisory was published by Notepad++ maintainer donho on August 24, 2026, and the fix was released the same day in version 8.9.8, indicating a rapid vendor response. The release received positive community engagement on GitHub with 52 reactions on the release page (v8.9.8 Release, GitHub Advisory).