Notepad++ CVE-2026-85288

Requires local write access to the current user's shortcuts.xml so a tampered/blocked macro can be planted, plus Notepad++ prior to 8.9.8 which enforces HMAC on the Macro-menu/shortcut path but not on the multi-run path. Exploitation is gated by user interaction: a user must open the 'Run a Macro Multiple Times' dialog (WM_MACRODLGRUNMACRO) to invoke macroPlayback(). Execution occurs only in the current user's context (no privilege elevation), and the affected macro must reference an internal command capable of launching external programs. These local-access, user-interaction, and high-complexity limits substantially constrain realistic risk despite the high C/I/A subscores.

This is a genuine but low-urgency defense-bypass, not a high-impact remote flaw. The CVSS 6.7 (AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) correctly reflects local-only exploitation requiring existing low-privilege access, high attack complexity, and user interaction. No EPSS score, no CISA KEV listing, and no public POC were provided - no public exploit identified at time of analysis. Critically, the vulnerability is a bypass of a self-protection control (shortcuts.xml HMAC integrity checking): the C:H/I:H/A:H impact is largely redundant because an attacker who can already tamper with shortcuts.xml in the user's config directory can generally run code as that user by other means. The CWE-78 (OS Command Injection) mapping and 'Command Injection' tag are technically defensible since blocked macros can invoke commands that launch external programs, but the real-world value to an attacker is marginal. Bottom line: this is a hardening/completeness fix for an integrity mechanism, not a priority patch versus internet-facing CVEs - the high C/I/A subscores overstate practical risk given the local-write precondition.

An attacker with local file-write access (or a malicious installer/script) modifies the user's shortcuts.xml to add a macro that invokes an internal Notepad++ command launching an external program. Although the tampered macro is blocked by HMAC validation through the Macro menu and shortcut keys, the victim invoking 'Run a Macro Multiple Times' triggers macroPlayback() directly, which skips the check and executes the payload in the current user's context. No public exploit code is known; exploitation is local, requires user interaction, and has high complexity.