Macro Execution Vulnerability in Notepad++ Source Code Editor
CVE-2026-85288

6.7MEDIUM

Key Information:

Vendor

Notepad-plus-plus

Status
Notepad-plus-plus
Vendor
CVE Published:
22 September 2026

What is CVE-2026-85288?

Notepad++ experiences a vulnerability related to incomplete enforcement of HMAC validation for the shortcuts.xml file. This flaw arises from the WM_MACRODLGRUNMACRO entry point calling macroPlayback() without proper validation, allowing potentially malicious macros to run. These tampered macros can bypass the standards enforced through the Macro menu or a shortcut key, leading to unauthorized execution of internal commands, including launching external applications. Users are advised to upgrade to version 8.9.8, where this issue has been resolved.

Affected Version(s)

notepad-plus-plus < 8.9.8

References

https://github.com/notepad-plus-plus/notepad-plus-plus/se...
x_refsource_CONFIRM
https://github.com/notepad-plus-plus/notepad-plus-plus/co...
x_refsource_MISC
https://github.com/notepad-plus-plus/notepad-plus-plus/re...
x_refsource_MISC

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.