CVE-2026-85288: Notepad++: Shortcuts.xml macro HMAC bypass still reachable via the "Run a Macro Multiple Times" dialog
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortcuts.xml HMAC validation because WMMACRODLGRUNMACRO, the Run a Macro Multiple Times entry point, calls macroPlayback() without the validation used by command(). A tampered shortcuts.xml macro that is blocked through the Macro menu or a shortcut key can therefore execute through the multi-run dialog and invoke internal Notepad++ commands, including commands that launch external programs, in the current user context. This issue is fixed in version 8.9.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Notepad++to a version that resolves this vulnerability.Fixed in 8.9.8
Event History
Frequently Asked Questions
Which installations are affected?
Notepad++ versions prior to 8.9.8 are affected. Version 8.9.8 fixes the incomplete HMAC validation.
What must an attacker be able to do to exploit this issue?
An attacker needs to tamper with the shortcuts.xml macro configuration and have the macro run through the Run a Macro Multiple Times dialog. The attack requires local access, low privileges, and user interaction.
What is the impact if exploitation succeeds?
The tampered macro can invoke internal Notepad++ commands, including commands that launch external programs. Those programs run in the context of the current user.
What should be done if a vulnerable version is in use?
Update Notepad++ to version 8.9.8. Until updated, do not run macros through the Run a Macro Multiple Times dialog when shortcuts.xml may have been modified.