CVE-2026-34401 in XmlNotepad

Sumário (Inglês)

XML Notepad is a Windows program that provides a simple intuitive User Interface for browsing and editing XML documents. Prior to version 2.9.0.21, XML Notepad does not disable DTD processing by default which means external entities are resolved automatically. There is a well known attack related to malicious DTD files where an attacker to craft a malicious XML file that loads a DTD that causes XML Notepad to make outbound HTTP/SMB requests, potentially leaking local file contents or capturing the victim's NTLM credentials. This issue has been patched in version 2.9.0.21.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Responsável

GitHub_M

Reservar

27/03/2026

Divulgação

01/04/2026

Estado

Confirmado

Inscrições

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidade	CWE	Exp	Con	CVE
354585	Microsoft XmlNotepad HTTP/SMB XML External Entity	611	Não definido	Correção oficial	CVE-2026-34401

Fontes

• MITRE
• NVD
• CVE Details