CVE-2026-52885

🗓️ 26 Jun 2026 20:19:04Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 56 Views🌐 WEB

Notepad++ TOCTOU: HMAC checks shortcuts.xml with in-memory commands; disk swap enables malware.

Reporter	Title	Published	Views	Family All 10
GithubExploit	Exploit for CVE-2026-52885	9 Jun 202617:37	–	githubexploit
ATTACKERKB	CVE-2026-52885	26 Jun 202620:19	–	attackerkb
Circl	CVE-2026-52885	9 Jun 202619:00	–	circl
Cvelist	CVE-2026-52885 Notepad++ TOCTOU: HMAC Checks Disk, Executes from Memory	26 Jun 202620:19	–	cvelist
EUVD	EUVD-2026-39906	26 Jun 202620:19	–	euvd
Tenable Nessus	Notepad++ 8.9.6.2 < 8.9.6.4 TOCTOU Race Condition (CVE-2026-52885)	3 Jul 202600:00	–	nessus
NVD	CVE-2026-52885	26 Jun 202621:16	–	nvd
OSV	CVE-2026-52885 Notepad++ TOCTOU: HMAC Checks Disk, Executes from Memory	26 Jun 202620:19	–	osv
Positive Technologies	PT-2026-52973	26 Jun 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-52885 Notepad++ TOCTOU: HMAC Checks Disk, Executes from Memory	26 Jun 202620:19	–	vulnrichment

NVD

Vulners

Node

notepad-plus-plus notepad++Range<8.9.6.4

[
  {
    "vendor": "notepad-plus-plus",
    "product": "notepad-plus-plus",
    "versions": [
      {
        "version": "< 8.9.6.4",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/notepad-plus-plus/notepad-plus-plus/commit/4f7563c7c7f8ffa0d795ec86a7777067c7d644b5
github	www.github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-qm4c-qg8p-qfcr

Parameter	Position	Path	Description	CWE
shortcuts.xml	path	shortcuts.xml	TOCTOU: HMAC check on disk at trigger time while payload loaded from memory at startup	CWE-367
_userCommands	path	shortcuts.xml	TOCTOU: HMAC check on disk at trigger time while payload loaded from memory at startup	CWE-367

29 Jun 2026 21:22Current

6Medium risk

Vulners AI Score6

CVSS 3.16.3

CVSS 47.5

EPSS0.00129

SSVC

CWE-367