CVE-2026-52885: Notepad++ Privilege Escalation Flaw

CVE-2026-52885 Overview

CVE-2026-52885 is a Time-of-Check to Time-of-Use (TOCTOU) race condition in Notepad++, a widely used free and open-source source code editor. The flaw resides in NppCommands.cpp, which validates the HMAC of the on-disk shortcuts.xml at command execution while the command payload is loaded from the in-memory _userCommands vector populated at application startup. An attacker with write access to shortcuts.xml can swap in a malicious file before launch, then restore the legitimate file so the HMAC integrity check passes while malicious payloads execute from memory. The issue is fixed in version 8.9.6.4.

Critical Impact
A local attacker with file write access can bypass HMAC integrity validation and execute attacker-controlled commands within Notepad++, undermining the shortcuts tamper-protection mechanism.

Affected Products

Notepad++ versions prior to 8.9.6.4
PowerEditor/src/NppCommands.cpp component
PowerEditor/src/Parameters.cpp component

Discovery Timeline

2026-06-26 - CVE-2026-52885 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-52885

Vulnerability Analysis

The vulnerability is a Time-of-Check to Time-of-Use race condition [CWE-367] affecting Notepad++'s shortcuts integrity protection. Notepad++ stores user-defined command shortcuts in shortcuts.xml and computes an HMAC bound to the machine GUID to detect tampering. The validation logic checks integrity at command execution time but operates on a payload cached in memory from application startup.

Because the check is performed against the current on-disk file rather than the in-memory command data actually being executed, an attacker can decouple the checked artifact from the used artifact. Successful exploitation results in execution of attacker-controlled shortcut commands with the privileges of the Notepad++ user, effectively defeating the HMAC mechanism designed to prevent tampering.

Root Cause

The root cause is a synchronization gap between disk and memory. In vulnerable versions, _userCommands is populated once at startup from shortcuts.xml and never re-synchronized. At command execution, computeHMAC(getMachineGUID(), getFileContent(nppParams.getShortcutsPath().c_str())) is compared against the stored config HMAC, but this check reads the current disk contents rather than the memory state that will actually run.

Attack Vector

Exploitation requires local write access to shortcuts.xml prior to Notepad++ launch. The attacker places a malicious shortcuts.xml on disk, allows Notepad++ to load it into _userCommands, then immediately restores the legitimate file. When the user triggers a shortcut, the HMAC check validates the restored clean file while the malicious command executes from the in-memory vector.

cpp

// Patch excerpt from PowerEditor/src/NppCommands.cpp
// If HMAC is present, calculate shortcuts.xml HMAC and compare with the one from config.xml
else
{
-    std::string currentShortcutsXmlHMAC = computeHMAC(getMachineGUID(), getFileContent(nppParams.getShortcutsPath().c_str()));
-
-    if (currentShortcutsXmlHMAC != nppGUI._shortcutsXmlHmacInConfig)
+    if (nppGUI._shortcutsOnDiskHmac != nppGUI._shortcutsXmlHmacInConfig)
    {
        // if they don't match, it means shortcuts.xml could be tampered with, so show warning message

Source: GitHub Commit 4f7563c

The fix caches the HMAC computed from disk at load time into _shortcutsOnDiskHmac, ensuring the check compares the same content that populated the in-memory command vector.

Detection Methods for CVE-2026-52885

Indicators of Compromise

Unexpected modifications to shortcuts.xml in the Notepad++ user configuration directory occurring around application launch times.
File replacement patterns showing shortcuts.xml being written, then reverted within a short window before or after notepad++.exe process start.
Notepad++ command execution events invoking unexpected shells, scripts, or binaries not defined by the legitimate user.

Detection Strategies

Monitor filesystem write events on %APPDATA%\Notepad++\shortcuts.xml and correlate with notepad++.exe process creation events.
Alert on child processes spawned by notepad++.exe that deviate from a documented baseline of legitimate user commands.
Track the installed Notepad++ version across endpoints and flag hosts running versions earlier than 8.9.6.4.

Monitoring Recommendations

Enable file integrity monitoring on all Notepad++ configuration files within user profile directories.
Log process ancestry for interpreters (cmd.exe, powershell.exe, wscript.exe) launched by notepad++.exe.
Review endpoint telemetry for rapid write-then-restore patterns on any configuration file consumed by user applications.

How to Mitigate CVE-2026-52885

Immediate Actions Required

Upgrade all Notepad++ installations to version 8.9.6.4 or later.
Audit permissions on shortcuts.xml and the containing directory to ensure only the intended user account has write access.
Inspect existing shortcuts.xml files across managed endpoints for unexpected or unauthorized command entries.

Patch Information

The vulnerability is patched in Notepad++ 8.9.6.4. The fix, provided in GitHub Commit 4f7563c, stores the HMAC computed at file load time in _nppGUI._shortcutsOnDiskHmac and compares that cached value at command execution, closing the TOCTOU window. Full details are available in the GitHub Security Advisory GHSA-qm4c-qg8p-qfcr.

Workarounds

Restrict local write access to the Notepad++ user configuration directory using NTFS ACLs where feasible.
Deploy application allowlisting to prevent unauthorized processes from modifying shortcuts.xml.
Where patching cannot be immediately applied, consider removing user-defined shortcut commands and monitoring the configuration file for tampering.

bash

# Verify installed Notepad++ version on Windows endpoints
powershell -Command "(Get-Item 'C:\Program Files\Notepad++\notepad++.exe').VersionInfo.FileVersion"

# Restrict write access on shortcuts.xml to the owning user only
icacls "%APPDATA%\Notepad++\shortcuts.xml" /inheritance:r /grant:r "%USERNAME%:(R,W)"