Notepad++ versions up to 8.9.6 are susceptible to high-severity arbitrary code execution (ACE) via CVE-2026-48800 and CVE-2026-48778 (CVSS 7.8). The vulnerabilities stem from a design flaw where the application implicitly trusts unvalidated XML configuration files stored in the user's %AppData% directory. Attackers can achieve ACE by injecting malicious commands into shortcuts.xml to manipulate the 'Run' menu or by hijacking the command-line interpreter path within config.xml. This vector enables reboot-surviving persistence that bypasses endpoint detection and response (EDR) tools focusing on the installation directory. Immediate remediation requires upgrading to version 8.9.6.1 or later.

• Vulnerability Mechanics: XML Configuration Trust

  • The flaw originates from the application's failure to validate integrity or origin for XML settings residing in the local user profile.
  • CVE-2026-48800 permits command injection through shortcuts.xml, allowing attackers to insert arbitrary executable paths into the application's 'Run' menu.
  • CVE-2026-48778 enables the redirection of the default command-line interpreter by manipulating path variables within config.xml.
  • CVE-2026-48770 (CVSS 5.0) introduces a medium-severity risk, allowing for application crashes (DoS) via malformed inter-process communication (IPC) messages.

• Exploitation Vectors: Delivery and Triggering

  • Local malware with user-level write permissions can directly modify configuration files to establish a foothold.
  • Social engineering attacks may distribute "poisoned" settings folders, tricking users into importing malicious XML configurations.
  • Cloud-synchronized application settings can propagate ACE configurations across multiple workstations automatically.
  • Malicious Windows shortcuts (.lnk) can be crafted to trigger the execution of the hijacked paths stored in the configuration.

• Security Impact: Stealth and Persistence

  • Achieves persistence by masking payloads as legitimate system utilities within the Notepad++ interface, surviving system reboots.
  • Bypasses traditional file integrity monitoring (FIM) and EDR, as modifications occur in %AppData% rather than the protected C:\Program Files directory.
  • Executes code within the security context of the logged-in user, facilitating potential lateral movement or further privilege escalation.

• Detection & Remediation: Defensive Requirements

  • Update immediately to Notepad++ version 8.9.6.1 or later to enforce strict validation of configuration files.
  • Monitor %AppData%\Notepad++ for unauthorized modifications to shortcuts.xml and config.xml via File Integrity Monitoring (FIM).
  • Implement behavioral rules to alert on anomalous child processes (e.g., powershell.exe, cmd.exe, scrcons.exe) spawned by notepad++.exe.
  • Audit the Notepad++ 'Run' menu for unrecognized entries or paths pointing to temporary directories or non-standard system locations.