CVE-2026-85288: Notepad++ Macro Validation Bypass RCE

CVE-2026-85288 Overview

CVE-2026-85288 is a security control bypass vulnerability in Notepad++, the widely used open-source source code editor for Windows. Versions prior to 8.9.8 incompletely enforce HMAC (Hash-based Message Authentication Code) validation on shortcuts.xml. The WM_MACRODLGRUNMACRO message handler, which powers the Run a Macro Multiple Times feature, invokes macroPlayback() without the integrity check applied by the standard command() path. An attacker who can tamper with shortcuts.xml can execute internal Notepad++ commands, including commands that launch external programs, in the current user context. The issue is fixed in Notepad++ 8.9.8.

Critical Impact
A tampered shortcuts.xml macro that is blocked through the Macro menu or shortcut key can still execute through the multi-run dialog, enabling arbitrary command execution in the user's context.

Affected Products

Notepad++ versions prior to 8.9.8
Windows installations using customized shortcuts.xml configurations
Notepad++ 8.9.8 contains the fix

Discovery Timeline

2026-09-22 - CVE-2026-85288 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-85288

Vulnerability Analysis

Notepad++ uses an HMAC stored in config.xml to verify the integrity of shortcuts.xml before executing user-defined macros. This mechanism prevents unauthorized modifications from silently altering keyboard shortcuts or macro definitions to invoke sensitive internal commands. The validation is enforced when macros are launched through the standard command() code path, which handles Macro menu selections and keyboard shortcut invocations.

The Run a Macro Multiple Times dialog uses a separate entry point. The WM_MACRODLGRUNMACRO window message routes execution directly to macroPlayback() without performing the HMAC comparison. A tampered macro that the standard path correctly blocks remains fully executable through the multi-run dialog. Because internal Notepad++ commands include the ability to launch external programs, this bypass enables arbitrary command execution in the current user context. The vulnerability is classified under CWE-78: OS Command Injection.

Root Cause

The root cause is inconsistent enforcement of a security control across multiple entry points into the same subsystem. The HMAC validation was implemented as a gate in command() but not shared by all callers of macroPlayback(). Any code path that reached macro execution without traversing command() inherited no protection.

Attack Vector

Exploitation requires local access and the ability to modify shortcuts.xml in the user profile. The attacker crafts a macro entry that invokes an internal command capable of launching an external program. The victim then opens Notepad++ and uses the Run a Macro Multiple Times dialog against the tampered macro, executing attacker-controlled commands under the current user account. User interaction is required.

cpp

// Security patch in PowerEditor/src/NppBigSwitch.cpp
// Adds HMAC validation to the multi-run macro entry point
{
    if (!_recordingMacro) // if we're not currently recording, then playback the recorded keystrokes
    {
        //-- shortcuts.xml security validation --//

        NppParameters& nppParams = NppParameters::getInstance();
        NppGUI& nppGUI = nppParams.getNppGUI();

        // If HMAC is absent from config.xml, force user enable security validation,
        // and generate and save HMAC in config.xml
        if (nppGUI._shortcutsXmlHmacInConfig.empty())
        {
            // Open shortcuts.xml in read-only for user to review
            BufferID shortcutsBufId = doOpen(nppParams.getShortcutsPath(), false, true);
            if (shortcutsBufId != BUFFER_INVALID)
            {
                switchToFile(shortcutsBufId);
                nppParams.getNativeLangSpeaker()->messageBox("ShortcutsXmlHMACMissing",
                    NULL,
                    L"The security information for shortcuts.xml is missing in config.xml...",
                    L"Security Warning",
                    MB_OK);
            }
            return FALSE;
        }
        // If HMAC is present, calculate shortcuts.xml HMAC and compare with the one from config.xml
        else
        {
            if (nppGUI._shortcutsOnDiskHmac != nppGUI._shortcutsXmlHmacInConfig)
            // ... reject execution on mismatch
        }
    }
}

Source: GitHub commit 4cd74cb

Detection Methods for CVE-2026-85288

Indicators of Compromise

Unexpected modifications to shortcuts.xml in the user's %APPDATA%\Notepad++ directory
Absent or mismatched _shortcutsXmlHmacInConfig value in config.xml
Notepad++ (notepad++.exe) spawning child processes such as cmd.exe, powershell.exe, or other interpreters
Macro entries in shortcuts.xml that reference internal commands used to launch external programs

Detection Strategies

Monitor process creation events where the parent process is notepad++.exe and the child is an interpreter or LOLBin
Track file modification events on shortcuts.xml outside of user-driven Notepad++ configuration workflows
Compare deployed Notepad++ version strings against 8.9.8 across managed endpoints to identify vulnerable installs

Monitoring Recommendations

Enable Windows Sysmon Event ID 1 (process create) and Event ID 11 (file create) with rules targeting Notepad++ paths
Alert on execution of the Run a Macro Multiple Times dialog followed by external process launches within a short interval
Baseline legitimate macro usage patterns per user to surface anomalous macro-driven command execution

How to Mitigate CVE-2026-85288

Immediate Actions Required

Upgrade all Notepad++ installations to version 8.9.8 or later
Audit shortcuts.xml files on shared or multi-user systems for unauthorized macro entries
Verify integrity of the _shortcutsXmlHmacInConfig value in config.xml after upgrade

Patch Information

The fix is available in Notepad++ v8.9.8. The code change is documented in GitHub commit 4cd74cb and the GitHub Security Advisory GHSA-759j-g8j4-867p. Additional context is available in the Notepad++ v8.9.8 release announcement. The patch adds HMAC validation to the WM_MACRODLGRUNMACRO handler so that the multi-run dialog enforces the same integrity checks as the standard command path.

Workarounds

Restrict write access to %APPDATA%\Notepad++\shortcuts.xml through NTFS permissions where feasible
Avoid using the Run a Macro Multiple Times feature until patched
Remove or reset custom macros and regenerate shortcuts.xml from a known-good source

bash

# Verify installed Notepad++ version on Windows endpoints via PowerShell
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "Notepad++*" } |
  Select-Object DisplayName, DisplayVersion, InstallLocation

# Flag installations below 8.9.8 for remediation