CVE-2026-71858: Notepad++ Privilege Escalation Vulnerability

CVE-2026-71858 Overview

CVE-2026-71858 is a local privilege escalation vulnerability in Notepad++ versions prior to 8.9.7. The flaw allows macros loaded from an attacker-controlled shortcuts.xml file to bypass the HMAC validation applied to UserDefinedCommands. An attacker who can influence the settingsDir location can craft a malicious shortcuts.xml that invokes Scintilla actions and the internal Open in Default Viewer command inside an elevated Notepad++ process. When a user triggers the malicious macro, the attacker can modify protected files and conditionally execute commands in an elevated context. The issue is fixed in Notepad++ version 8.9.7.

Critical Impact
Local attackers with write access to settingsDir can achieve protected file modification and conditional elevated command execution when a user triggers a crafted macro.

Affected Products

Notepad++ versions prior to 8.9.7
Notepad++ macro subsystem processing shortcuts.xml
Notepad++ UserDefinedCommands HMAC validation logic

Discovery Timeline

2026-08-17 - CVE-2026-71858 published to NVD
2026-08-17 - Last updated in NVD database
Version 8.9.7 - Fix released via GitHub Release v8.9.7

Technical Details for CVE-2026-71858

Vulnerability Analysis

Notepad++ applies HMAC validation to UserDefinedCommands entries in shortcuts.xml to ensure integrity. However, the macro loading path does not enforce equivalent validation on macro definitions within the same file. An attacker who controls shortcuts.xml can define macros that invoke Scintilla actions and the internal Open in Default Viewer command. When Notepad++ runs elevated, these actions inherit the elevated token. This enables protected file writes outside the user's normal permission scope and conditional command execution through the default viewer handler. The weakness maps to [CWE-78] related command handling in a privileged process context.

Root Cause

The root cause is inconsistent integrity validation across the shortcuts.xml schema. UserDefinedCommands are HMAC-protected, but macro entries containing Scintilla message invocations and the Open in Default Viewer command are not. Because Notepad++ trusts the parsed macro sequence, any attacker who can write shortcuts.xml bypasses the intended tamper-resistance boundary.

Attack Vector

Exploitation requires local access. The attacker must influence settingsDir so Notepad++ loads a crafted shortcuts.xml. A user must then launch Notepad++ (potentially elevated) and trigger the malicious macro via its bound shortcut or menu entry. Once triggered, the macro executes Scintilla actions and the Open in Default Viewer command inside the elevated process, enabling protected file modification and conditional elevated command execution.

cpp

// Security patch excerpt from PowerEditor/src/Notepad_plus.cpp (v8.9.7)
// Source: https://github.com/notepad-plus-plus/notepad-plus-plus/commit/7686e5a3025eaf1fb8e024c2ceb54670ea05f5fb
_statusBar.setPartWidth(STATUSBAR_CUR_POS, DPIManagerV2::scale(260, dpi));
_statusBar.setPartWidth(STATUSBAR_EOF_FORMAT, DPIManagerV2::scale(110, dpi));
_statusBar.setPartWidth(STATUSBAR_UNICODE_TYPE, DPIManagerV2::scale(120, dpi));
-_statusBar.setPartWidth(STATUSBAR_TYPING_MODE, DPIManagerV2::scale(40, dpi));
+_statusBar.setPartWidth(STATUSBAR_TYPING_MODE, DPIManagerV2::scale(45, dpi));
_statusBar.display(willBeShown);

The full commit extends HMAC coverage to the macro subsystem. See the GitHub Security Advisory GHSA-f4rj-vqq4-wvg4 for the complete change set.

Detection Methods for CVE-2026-71858

Indicators of Compromise

Unexpected modifications to shortcuts.xml within the Notepad++ settingsDir path
Presence of macro entries invoking Open in Default Viewer referencing protected file paths
Notepad++ processes running elevated that spawn child handlers for non-text file associations
Writes to protected directories originating from notepad++.exe under an elevated token

Detection Strategies

Monitor file integrity on shortcuts.xml in every user profile and shared Notepad++ install directory
Alert on Notepad++ launched with elevated privileges that subsequently triggers ShellExecute or default viewer handlers
Correlate macro playback events with writes to Program Files, Windows, or other ACL-restricted locations

Monitoring Recommendations

Track process creation chains where notepad++.exe is the parent of unexpected default viewer applications
Log changes to Notepad++ configuration directories and forward events to a central data lake for review
Baseline legitimate shortcuts.xml content and flag deviations in macro sections

How to Mitigate CVE-2026-71858

Immediate Actions Required

Upgrade all Notepad++ installations to version 8.9.7 or later
Audit every shortcuts.xml file across user profiles and shared install paths for unauthorized macro entries
Restrict write permissions on the Notepad++ settingsDir to prevent unprivileged tampering

Patch Information

The fix is available in Notepad++ 8.9.7. See the GitHub Commit Update for the patch and GitHub Release v8.9.7 for release notes. The patch extends HMAC validation to macro entries and hardens the internal Open in Default Viewer invocation path.

Workarounds

Avoid running Notepad++ with elevated privileges until the patch is applied
Set the Notepad++ configuration directory to a per-user location with ACLs preventing write access by other users
Remove or replace any untrusted shortcuts.xml files with a known-good baseline

bash

# Verify installed Notepad++ version on Windows endpoints
powershell -Command "Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Notepad++' | Select-Object DisplayVersion"

# Restrict shortcuts.xml to the current user only
icacls "%APPDATA%\Notepad++\shortcuts.xml" /inheritance:r /grant:r "%USERNAME%:(R,W)"