CVE-2026-34401

XML Notepad is a Windows program that provides a simple intuitive User Interface for browsing and editing XML documents. Prior to version 2.9.0.21, XML Notepad does not disable DTD processing by default which means external entities are resolved automatically. There is a well known attack related to malicious DTD files where an attacker to craft a malicious XML file that loads a DTD that causes XML Notepad to make outbound HTTP/SMB requests, potentially leaking local file contents or capturing the victim's NTLM credentials. This issue has been patched in version 2.9.0.21.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/microsoft/XmlNotepad/commit/3665603d61ba10b7827a3724e854748cb780140c	Patch
https://github.com/microsoft/XmlNotepad/commit/c03ab2311ac6960452eb1ab49098768f851dcc53	Patch
https://github.com/microsoft/XmlNotepad/releases/tag/2.9.0.21	Product Release Notes
https://github.com/microsoft/XmlNotepad/security/advisories/GHSA-5j32-486h-42ch	Mitigation Vendor Advisory
https://github.com/microsoft/XmlNotepad/security/advisories/GHSA-5j32-486h-42ch	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:microsoft:xml_notepad:*:*:*:*:*:windows:*:*

History

No history.

Information

Published : 2026-03-31 22:16

Updated : 2026-07-24 21:10

NVD link : CVE-2026-34401

Mitre link : CVE-2026-34401

CVE.ORG link : CVE-2026-34401

JSON object : View

Products Affected

microsoft

xml_notepad

CWE

CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2026-34401", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34401", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-01T15:45:24.184266Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "microsoft", "product": "XmlNotepad", "versions": [{"status": "affected", "version": "< 2.9.0.21"}]}]}], "published": "2026-03-31T22:16:18.490", "references": [{"url": "https://github.com/microsoft/XmlNotepad/commit/3665603d61ba10b7827a3724e854748cb780140c", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/microsoft/XmlNotepad/commit/c03ab2311ac6960452eb1ab49098768f851dcc53", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/microsoft/XmlNotepad/releases/tag/2.9.0.21", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/microsoft/XmlNotepad/security/advisories/GHSA-5j32-486h-42ch", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/microsoft/XmlNotepad/security/advisories/GHSA-5j32-486h-42ch", "tags": ["Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "XML Notepad is a Windows program that provides a simple intuitive User Interface for browsing and editing XML documents. Prior to version 2.9.0.21, XML Notepad does not disable DTD processing by default which means external entities are resolved automatically. There is a well known attack related to malicious DTD files where an attacker to craft a malicious XML file that loads a DTD that causes XML Notepad to make outbound HTTP/SMB requests, potentially leaking local file contents or capturing the victim's NTLM credentials. This issue has been patched in version 2.9.0.21."}, {"lang": "es", "value": "XML Notepad es un programa de Windows que proporciona una interfaz de usuario sencilla e intuitiva para navegar y editar documentos XML. Antes de la versi\u00f3n 2.9.0.21, XML Notepad no deshabilita el procesamiento de DTD por defecto, lo que significa que las entidades externas se resuelven autom\u00e1ticamente. Existe un ataque bien conocido relacionado con archivos DTD maliciosos donde un atacante puede crear un archivo XML malicioso que carga un DTD que hace que XML Notepad realice solicitudes HTTP/SMB salientes, potencialmente filtrando el contenido de archivos locales o capturando las credenciales NTLM de la v\u00edctima. Este problema ha sido parcheado en la versi\u00f3n 2.9.0.21."}], "lastModified": "2026-07-24T21:10:00.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:xml_notepad:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "F08C7164-A566-4527-8764-F9BC54E164F1", "versionEndExcluding": "2.9.0.21"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}