Is CVE-2026-52885 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-52885 being exploited in the wild.

How severe is CVE-2026-52885?

Informational severity, with a CVSS score of 7.5, published 26 June 2026.

Is there a fix for CVE-2026-52885?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-52885 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-52885?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52885: Notepad++ TOCTOU race condition in shortcuts.xml HMAC check

CVE-2026-52885 · Severity: info · CVSS 7.5 · Published 2026-06-26

Notepad++ is a popular open-source text and source code editor. A security flaw allows an attacker with local file access to bypass security checks and execute unauthorized commands. By swapping a configuration file during the application's startup process, an attacker can trick the software into running malicious code while appearing to validate a legitimate file. This could lead to a full system compromise or unauthorized data access on the user's machine.

Quick answers

Is CVE-2026-52885 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-52885 being exploited in the wild.
How severe is CVE-2026-52885?: Informational severity, with a CVSS score of 7.5, published 26 June 2026.
Which products and versions are affected?: Notepad++ Notepad++ < 8.9.6.4.
Is there a fix for CVE-2026-52885?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-52885 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-52885?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in Notepad++ versions prior to 8.9.6.4 within the HMAC validation logic for user commands. The application populates an internal memory vector (_userCommands) with command payloads from 'shortcuts.xml' at startup. When a command is triggered, the software performs an HMAC integrity check against the 'shortcuts.xml' file currently on disk; however, it then executes the command stored in memory rather than the one just validated on disk. An attacker with local write access can place a malicious 'shortcuts.xml' file on disk before launch to populate the memory vector, then quickly replace it with a legitimate version. The subsequent HMAC check succeeds against the legitimate file, but the malicious command from memory is executed. This vulnerability is addressed in version 8.9.6.4 by ensuring the HMAC check and execution use consistent data.

Affected products

Notepad++ Notepad++ < 8.9.6.4

Timeline

2026-06-04: advisory: GitHub Security Advisory GHSA-qm4c-qg8p-qfcr published
2026-06-26: disclosed: CVE-2026-52885 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.