{
  "cveId": "CVE-2026-71858",
  "url": "https://patchblox.com/security/cve/CVE-2026-71858",
  "summary": "CVE-2026-71858 is fixed in Notepad\u002B\u002B on 1 platform by Notepad\u002B\u002B 8.9.7 (version 8.9.7), released July 14, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "Notepad\u002B\u002B: shortcuts.xml Macro HMAC Bypass Enables Conditional Elevated Command Execution",
  "description": "Notepad\u002B\u002B is a free and open-source source code editor. Prior to 8.9.7, macros loaded from an attacker-controlled shortcuts.xml bypass the HMAC validation applied to UserDefinedCommands and can invoke Scintilla actions and the internal Open in Default Viewer command in an elevated Notepad\u002B\u002B process, allowing protected file modification and conditional elevated command execution when a local attacker influences settingsDir and a user triggers the macro. This issue is fixed in version 8.9.7.",
  "published": "2026-08-17T20:16:46Z",
  "severity": "",
  "cvss": 5.4,
  "cwe": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
  "epss": 0.00121,
  "epssPercentile": 0.01884,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://nvd.nist.gov/vuln/detail/CVE-2026-71858",
  "fixes": [
    {
      "platform": "windows-app",
      "product": "Notepad\u002B\u002B",
      "fixedVersion": "8.9.7",
      "fix": "Notepad\u002B\u002B 8.9.7",
      "url": "https://patchblox.com/security/fix/windows-app/notepad-.notepad-8.9.7",
      "released": "2026-07-14T00:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}