Notepad++ EUVD-2026-39904

Exploitation requires (1) the attacker to write to the victim's shortcuts.xml configuration file and inject a crafted <Command> value inside <UserDefinedCommands>, and (2) the victim to subsequently click the malicious entry in Notepad++'s Run menu (UI:R). Limiting factors: the attack vector is local (AV:L) - there is no remote or network trigger; it depends on first gaining filesystem write access to the user's Notepad++ config, and on the victim interacting with the planted menu item; it affects only Windows installations of Notepad++ prior to 8.9.6.1. Not exploitable against an unmodified configuration or without that initial local write access.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8 High) accurately frames this as a local, low-complexity issue requiring victim interaction (clicking the Run-menu entry) but yielding full confidentiality, integrity, and availability impact via arbitrary code execution in the user's context. The practical prerequisite - the ability to write to the victim's shortcuts.xml - is not captured by PR:N: an attacker already needs local filesystem write access to that profile or another tampering channel, so this is realistically a privilege-persistence / post-compromise primitive rather than an initial remote-access bug. No EPSS score, SSVC decision, KEV listing, or public POC was provided, and there is no public exploit identified at time of analysis, so exploitation is currently theoretical. Net assessment: a legitimate priority for endpoints where untrusted code or other users can modify Notepad++ config files, but lower urgency than the raw 7.8 suggests for typical single-user workstations because it is not remotely or autonomously exploitable.

An attacker with local write access to a user's Notepad++ profile (for example via prior low-privilege access, a shared workstation, or a malicious installer) edits shortcuts.xml to add a <Command> entry whose text is a path to a malicious executable, labeled as a benign-looking Run-menu item. The next time the victim opens that Run-menu entry, ShellExecute launches the attacker's binary in the victim's context. No public POC is referenced, but the low attack complexity makes weaponization straightforward once file-write access is obtained.