notepad-plus-plus Notepad++ up to 8.9.6.4 NppCommands.cpp toctou

Summaryinfo

A vulnerability labeled as problematic has been found in notepad-plus-plus Notepad++ up to 8.9.6.4. Affected by this vulnerability is an unknown functionality of the file NppCommands.cpp. Executing a manipulation can lead to toctou. This vulnerability is registered as CVE-2026-52885. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in notepad-plus-plus Notepad++ up to 8.9.6.4 and classified as problematic. This vulnerability affects an unknown part of the file NppCommands.cpp. The manipulation with an unknown input leads to a toctou vulnerability. The CWE definition for the vulnerability is CWE-367. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Notepad++ is a free and open-source source code editor. Prior to 8.9.6.4, NppCommands.cpp checks the HMAC of the on-disk shortcuts.xml at the moment a user command fires (Time-of-Check). However, the command payload is taken from the in-memory _userCommands vector, which is populated at application startup and never re-synchronized with the on-disk file (Time-of-Use). Swapping shortcuts.xml between startup and command execution causes the HMAC check to validate a clean file while a malicious command runs. An attacker with write access to shortcuts.xml places a malicious version on disk before launch, then immediately restores the legitimate file. The HMAC check at execution time validates the restored legitimate file (check passes), while the malicious payload executes from memory. This vulnerability is fixed in 8.9.6.4.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-52885 since 06/08/2026. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

Upgrading to version 8.9.6.4 eliminates this vulnerability. Applying the patch 4f7563c7c7f8ffa0d795ec86a7777067c7d644b5 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-39906). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Document Reader Software

Vendor

• notepad-plus-plus

Name

• Notepad++

Version

• 8.9.6.0
• 8.9.6.1
• 8.9.6.2
• 8.9.6.3
• 8.9.6.4

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion