Time-of-Check to Time-of-Use Issue in Notepad++ Affects User Command Safety

CVE-2026-52885

What is CVE-2026-52885?

A vulnerability in Notepad++ prior to version 8.9.6.4 allows an attacker to exploit the time-of-check to time-of-use (TOCTOU) flaw in the handling of user command shortcuts. The application checks the HMAC of the 'shortcuts.xml' file when a command is executed, but this check is based on an in-memory version created at startup, which remains unsynchronized with the disk version. An attacker with write access can replace 'shortcuts.xml' with a malicious version between the time of application launch and command execution. Consequently, the HMAC validation passes for the legitimate file, while a harmful command executes from memory, compromising user security.

References