CVE-2026-52885: Notepad++ Time-of-Check-Time-of-Use (TOCTOU) Vulnerability in Command Execution

Technical summary

The vulnerability stems from a classic TOCTOU flaw in NppCommands.cpp. Notepad++ loads user commands from shortcuts.xml into the _userCommands in-memory vector during startup. Later, when a user executes a command, the application performs an HMAC integrity check on the current on-disk shortcuts.xml file (Time-of-Check). However, the actual command payload execution reads from the cached _userCommands vector, which was never re-synchronized with the disk file after startup (Time-of-Use). An attacker with local file write permissions can: (1) place a malicious shortcuts.xml before application startup; (2) wait for Notepad++ to load and cache the malicious payload in memory; (3) restore the legitimate shortcuts.xml to disk; (4) trigger command execution, causing the HMAC check to validate the now-legitimate file while the in-memory malicious payload executes. The CWE-367 classification (Time-of-check Time-of-use) directly reflects this architectural flaw. Versions 8.9.6.4 and later patch this by ensuring the command payload is re-validated or re-loaded at execution time, closing the window between check and use.

Business impact

This vulnerability enables local privilege escalation or arbitrary code execution for attackers who already possess write access to Notepad++ configuration files. In shared workstation environments or scenarios where user home directories are mounted on network shares with relaxed permissions, an attacker could inject malicious commands that execute with the privileges of whoever launches Notepad++. The attack requires local file access and user interaction (launching Notepad++ and triggering a command), making it primarily a risk in multi-user systems or environments where an attacker has achieved initial file system write access. For organizations using Notepad++ in development, security analysis, or administrative workflows, successful exploitation could lead to unintended code execution, data theft, or lateral movement. The impact is contained to the local system and the user's privilege level.

Affected systems

Notepad++ versions prior to 8.9.6.4 are affected. The vulnerability is specific to Notepad++ (notepad++) and does not impact other text editors or Notepad (the Windows built-in editor). Organizations should inventory Notepad++ deployments, particularly on shared workstations, developer machines, and systems used by privileged users. The vulnerability does not affect Notepad++ instances where the shortcuts.xml file resides on read-only file systems or where file system permissions prevent unauthorized modification by other local users.

Exploitability

Practical exploitation requires multiple conditions: the attacker must have local write access to the target user's Notepad++ configuration directory (typically ~/.config/notepad++/ on Linux or %AppData%\Notepad++\ on Windows); the attacker must be able to swap the shortcuts.xml file between startup and command execution, implying either code execution, scheduled access, or a race condition; and the target user must execute a user-defined command after application launch. The CVSS vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H) reflects that this is a local attack with high complexity, requiring low privileges but not user interaction at exploitation time (though user interaction is required to trigger the vulnerable command). The lack of public exploit code and KEV status designation indicate this remains a theoretical but credible threat rather than an actively weaponized vulnerability in the wild.

Remediation

Upgrade Notepad++ to version 8.9.6.4 or later. Users should verify their current version via Help > About Notepad++. Administrators can automate Notepad++ updates through standard patch management channels if deployment is managed organizationally. For users unable to update immediately, mitigations include: restricting file system permissions on the Notepad++ configuration directory to prevent other local users from modifying shortcuts.xml; disabling user-defined commands if not required; and monitoring the shortcuts.xml file for unauthorized changes. However, these mitigations do not eliminate the underlying flaw and should be treated as temporary measures only.

Patch guidance

Verify the installed version of Notepad++ and confirm it is 8.9.6.4 or later. The patch is available through the official Notepad++ GitHub releases page and is also distributed via the Windows installer and portable editions. Organizations should test the update in a development environment first to ensure compatibility with any custom user command sets before broad deployment. The patch maintains backward compatibility and does not require migration of existing shortcuts.xml files.

Detection guidance

Monitor for suspicious modifications to Notepad++ configuration files, particularly shortcuts.xml, especially if modifications occur shortly before or after Notepad++ process execution. Endpoint detection and response (EDR) solutions should flag rapid file write-and-restore patterns on configuration files as potential TOCTOU exploitation attempts. Process execution monitoring can help identify if Notepad++ launches unexpected child processes or performs unexpected network activity following command execution. Log file integrity monitoring on shortcuts.xml can detect unauthorized edits, though the attacker's temporary restoration may evade some tools. Behavioral detection of commands executing with unexpected privilege levels or from unexpected locations is also valuable.

Why prioritize this

Although the CVSS score is 6.3 (MEDIUM), this vulnerability merits prompt prioritization in environments with shared workstations or elevated-privilege Notepad++ users. The integrity bypass is subtle but reliable once conditions are met, and the patch is simple to deploy with no known side effects. Prioritize systems where Notepad++ is used by developers, security analysts, or system administrators, and systems where file permissions may permit lateral write access to user directories. KEV non-designation suggests active exploitation is not yet widespread, providing a narrow window for patching before attackers discover this vector.

Risk score, explained

The CVSS 3.1 score of 6.3 (MEDIUM) reflects the combination of local-only attack surface (AV:L), high attack complexity (AC:H), low privilege requirement (PR:L), no integrity impact on the system itself (I:H only on user intent/data), high availability impact through process termination (A:H), and the fact that successful exploitation requires the attacker to already possess local file write access and timing precision. The score appropriately discounts scenarios where multi-user environments are the exception and acknowledges that the attack is feasible but non-trivial. Organizations with elevated Notepad++ users or shared development systems may reasonably rate this higher internally than the base CVSS score suggests.

Frequently asked questions