CVE-2026-85288 notepad-plus-plus CVE debrief

Who should care

Defenders and administrators responsible for Notepad++ installations, especially in environments where macros are used or where Notepad++ is used to edit and execute macros, should assess exposure and prioritize updating to version 8.9.8 or later.

Why it matters

Defenders should prioritize updating Notepad++ to version 8.9.8 or later due to a vulnerability allowing tampered macro execution, potentially leading to command execution or external program invocation in the current user context. This issue is particularly relevant for environments where Notepad++ is used for editing and executing macros. The vulnerability's impact requires verification from official sources, and updating to the fixed version is the recommended remediation.

• Potential execution of arbitrary commands in the current user context
• Possible invocation of external programs through Notepad++
• Macro execution bypassing normal validation

Technical summary

Notepad++ prior to 8.9.8 incompletely enforces shortcuts.xml HMAC validation, allowing tampered macros to execute through the multi-run dialog and potentially invoke internal Notepad++ commands or external programs. The vulnerability is specifically associated with the WM_MACRODLGRUNMACRO entry point, which calls macroPlayback() without the validation used by command(). This oversight enables a tampered shortcuts.xml macro, blocked through the Macro menu or a shortcut key, to execute through the multi-run dialog. Consequently, an attacker could exploit this vulnerability to invoke internal Notepad++ commands or launch external programs in the current user context. The issue is addressed in Notepad++ version 8.9

Defensive priority

Defenders should prioritize updating to version 8.9.8 or later to address this vulnerability, especially in environments where Notepad++ is used to edit and execute macros.

Recommended defensive actions

• Update Notepad++ to version 8.9.8 or later
• Review and restrict macro execution in Notepad++
• Monitor Notepad++ usage for suspicious activity
• Verify Notepad++ configurations and user permissions
• Implement additional monitoring for macro execution
• Review Notepad++ logs for signs of tampered macro execution
• Conduct regular security audits of Notepad++ installations

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the corpus does not establish versions, exploitation, impact, or remediation beyond updating to 8.9.8.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.