Notepad++ EUVD-2026-39906

Requires local write access to the on-disk shortcuts.xml file and the ability to win a timing race: the attacker must place the malicious shortcuts.xml before Notepad++ startup (when _userCommands is populated) and restore the legitimate file before the command-time HMAC check executes. Exploitation further depends on the victim subsequently triggering a user-defined command whose payload was loaded from the tampered file. Limiting factors: it is local-only (AV:L) with high complexity (AC:H) due to the swap window, it does not work against a read-only or properly permission-restricted shortcuts.xml, and it requires the attacker to already control or write to the victim's Notepad++ configuration files - so an attacker with no prior local file-write foothold cannot exploit it.

The supplied CVSS 4.0 vector (AV:L/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, base 7.5) correctly reflects a local-only attack with high complexity due to the race window, but high impact to confidentiality, integrity and availability since arbitrary user commands run. There is no EPSS score, KEV listing, or POC provided, so real-world exploitation pressure is low and opportunistic mass exploitation is implausible - this is a precondition-heavy local issue, not an internet-facing RCE. Note a tension worth flagging: PR:N is asserted, yet the attack inherently requires write access to shortcuts.xml, which is effectively a local-privilege/foothold prerequisite - defenders should treat this as requiring prior local file-write access rather than zero privileges. The 'Information Disclosure' tag undersells the issue; the true impact is integrity bypass leading to execution of attacker-controlled commands. Overall this is a moderate, defense-in-depth priority for managed Windows fleets rather than an emergency.

An attacker who already has write access to a victim's shortcuts.xml (for example via a prior low-privilege foothold or a writable shared profile path) replaces the file with one defining a malicious command, then restores the legitimate file once Notepad++ has loaded the tampered commands into memory. When the user triggers the affected command, the runtime HMAC check validates the restored clean file and passes, while the attacker's command executes from memory. No public POC is identified, and the high attack complexity reflects the need to win the startup-to-restore timing race.