CVE-2026-71858
Received Received - Intake

Macro Execution Flaw in Notepad++ Allows Privilege Escalation

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, macros loaded from an attacker-controlled shortcuts.xml bypass the HMAC validation applied to UserDefinedCommands and can invoke Scintilla actions and the internal Open in Default Viewer command in an elevated Notepad++ process, allowing protected file modification and conditional elevated command execution when a local attacker influences settingsDir and a user triggers the macro. This issue is fixed in version 8.9.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-18
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-71858
EUVD
EUVD-2026-60373

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
notepad++ notepad++ 8.9.7
notepad%2b%2b notepad%2b%2b 8.9.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Notepad++ allows bypassing HMAC validation for macros loaded from an attacker-controlled shortcuts.xml file. It enables execution of Scintilla actions and internal commands in an elevated Notepad++ process, potentially modifying protected files or running arbitrary commands.

Detection Guidance

Check Notepad++ version with 'notepad++ --version' or via Help > About. If version is below 8.9.7, the system is vulnerable. Inspect shortcuts.xml in Notepad++ settings directory for unexpected macros or commands.

Impact Analysis

An attacker could modify protected system files or execute commands with elevated privileges if they can influence settingsDir and trick a user into triggering a malicious macro. This requires local access and user interaction.

Compliance Impact

This vulnerability primarily affects file integrity and command execution controls, which could lead to unauthorized file modifications or elevated command execution. While not directly tied to GDPR or HIPAA, such unauthorized access or modifications could potentially violate compliance requirements that mandate data integrity, access controls, and audit logging.

Mitigation Strategies

Update Notepad++ to version 8.9.7 or later immediately. Remove any untrusted macros from shortcuts.xml. Restrict write access to Notepad++ settings directory to prevent tampering.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71858. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart