Notepad++ v8.9.6 — Critical Arbitrary Code Execution via config.xml commandLineInterpreter and shortcuts.xml (CVE-2026-48770, CVE-2026-48778, CVE-2026-48800) — Threadlinqs Intelligence
As of 2026-05-30, Notepad++ v8.9.6 — Critical Arbitrary Code Execution via config.xml commandLineInterpreter and shortcuts.xml (CVE-2026-48770, CVE-2026-48778, CVE-2026-48800) is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 12 indicators of compromise.
Threat ID: TL-2026-0613 · Severity: CRITICAL · CVSS: 7.8 · Status: PATCHED · Category: VULNERABILITY
Notepad++ versions <= v8.9.6 are affected by three vulnerabilities patched in v8.9.6.1 (released 2026-05-26): CVE-2026-48778 and CVE-2026-48800 are critical arbitrary code execution flaws caused by
Notepad++ is one of the most widely deployed Windows source-code editors, present on millions of developer workstations and enterprise endpoints. On 2026-05-26 the Notepad++ project released v8.9.6.1, patching three vulnerabilities disclosed by independent security researchers and summarised in Cyber Security News (2026-05-28).
## CVE-2026-48778 — Arbitrary Code Execution via config.xml (CRITICAL)
Notepad++ persists user preferences in %APPDATA%\Notepad++\config.xml. Among many tags is <GUIConfig name="commandLineInterpreter">, which holds the path to the shell invoked by the File -> Open Containing Folder -> cmd context menu. At load time, Parameters.cpp calls NppXml::value() to extract the tag's text content and stores it verbatim — no whitelist, no canonicalisation against %SystemRoot%\System32, no Authenticode check, no length cap.
When the user selects Open Containing Folder -> cmd, Notepad++ builds a command object from the stored string and hands it to ShellExecute(). Because ShellExecute() honours .exe extensions, fully-qualified paths and even URL handlers, the attacker has direct code execution as the interactive user. A publicly demonstrated PoC sets the tag to calc.exe and launches Windows Calculator the next time the menu item is used — confirming full arbitrary code execution capability.
## CVE-2026-48800 — Arbitrary Code Execution via shortcuts.xml (CRITICAL)
Shares the exploitation pattern of CVE-2026-48778 but targets shortcuts.xml (%APPDATA%\Notepad++\shortcuts.xml), the file storing user-bound keyboard shortcuts and macro command associations. The same NppXml::value() -> ShellExecute() flow allows an attacker who can write shortcuts.xml to inject an executable that fires when the bound keystroke or menu item is triggered.
## CVE-2026-48770 — Crash via malformed XML (HIGH)
Notepad++ fails to gracefully handle malformed XML structure during configuration parsing, leading to an application crash. While the crash itself is not remote code execution, it provides denial-of-service capability and may be useful as a precursor primitive for race conditions or partial-state corruption.
## Attack Vectors
Four realistic delivery paths are documented in the disclosure:
1. **Direct same-user write** — Any process running under the victim's user account (low-priv malware, a malicious script, an unsigned tool the user ran once) can drop a tampered config.xml or shortcuts.xml into %APPDATA%\Notepad++\. No elevation required.
2. **Malicious .lnk + -settingsDir= flag** — Notepad++ accepts a -settingsDir=<path> command-line flag that overrides the location of its configuration directory. An attacker delivering a shortcut (or a phishing email with a .lnk attachment) can point Notepad++ at an attacker-staged settings directory containing the tampered XML. The user simply launching the shortcut is sufficient.
3. **Cloud sync poisoning** — Notepad++ supports a user-configurable cloud path for settings. Compromise of the cloud storage account (or of a single endpoint in a sync group) propagates the tampered config to every other endpoint in the same sync set.
4. **Archive extraction social engineering** — Crafted archives (zip/rar/7z) containing a config.xml under a relative AppData-like path can be tricked into landing in %APPDATA%\Notepad++\ via path-traversal-aware extractors or simple user error.
## Exploitation Reliability
The attack is deterministic: any time the user invokes the affected menu item or shortcut, the planted payload executes. No memory corruption, no ASLR/DEP bypass, no race window. Triggering does require user interaction (Open Containing Folder -> cmd, or the bound keystroke), which is why CVSS scoring places this in the local/user-interaction band rather than network-remote — but in interactive desktop environments it is essentially click-to-pwn.
## Detection and Defensive Implications
Because the payload runs as the Notepad++ child process via ShellExecute(), defenders should focus on:
- Parent
Weaknesses (CWE)
CWE-78, CWE-20, CWE-94, CWE-426, CWE-829
Target sectors: technology, software-development, government, financial, healthcare, education, enterprise-it
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 12 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-48770, CVE-2026-48778, CVE-2026-48800, T1566, T1566.001, T1080, T1204, T1204.002, T1204.001, T1059, T1059.003, T1059.001, T1203