Executive brief
Microsoft XML Notepad is a Windows application used for viewing and editing XML files. A security flaw allows a malicious XML file to force the application to make unauthorized connections to external servers or read local files when opened. This could lead to the theft of sensitive local data or the capture of the user's Windows login credentials (NTLM hashes).
Technical details
XML Notepad prior to version 2.9.0.21 is vulnerable to XML External Entity (XXE) injection (CWE-611) because it does not disable Document Type Definition (DTD) processing by default. When a user opens a specially crafted XML file, the XmlTextReader automatically resolves external entities. This allows an attacker to trigger outbound HTTP or SMB requests without further user interaction. Exploitation can result in the exfiltration of local file contents (e.g., configuration files) or the capture of NTLM hashes for offline cracking or relay attacks. The fix in version 2.9.0.21 changes the default 'Ignore DTD' setting to True.
Affected products
- Microsoft XmlNotepad < 2.9.0.21
Timeline
- 2026-03-28: patched: Version 2.9.0.21 released
- 2026-03-30: advisory: GitHub Security Advisory published
- 2026-03-31: disclosed: CVE published to NVD
References
- https://github.com/microsoft/XmlNotepad/commit/3665603d61ba10b7827a3724e854748cb780140c
- https://github.com/microsoft/XmlNotepad/commit/c03ab2311ac6960452eb1ab49098768f851dcc53
- https://github.com/microsoft/XmlNotepad/releases/tag/2.9.0.21
- https://github.com/microsoft/XmlNotepad/security/advisories/GHSA-5j32-486h-42ch