PT-2026-29357 · Microsoft · Xmlnotepad

Infosecninja · Published 2026-03-31 · Updated 2026-04-01 · CVE-2026-34401

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions XML Notepad versions prior to 2.9.0.21

Description XML Notepad, a Windows program for editing XML documents, does not disable DTD processing by default before version 2.9.0.21. This allows for the resolution of external entities. An attacker can craft a malicious XML file containing a DTD that causes XML Notepad to make outbound HTTP/SMB requests, potentially leading to the leakage of local file contents or the capture of the victim's NTLM credentials. The API endpoints and vulnerable parameters are not explicitly mentioned in the provided information.

Recommendations Update XML Notepad to version 2.9.0.21 or later.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2026-34401

GHSA-5J32-486H-42CH

Affected Products

Xmlnotepad

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34401.json · Exploit
• 🔥 https://github.com/microsoft/XmlNotepad/security/advisories/GHSA-5j32-486h-42ch · Exploit
• https://github.com/microsoft/XmlNotepad/commit/c03ab2311ac6960452eb1ab49098768f851dcc53 · Patch
• https://github.com/microsoft/XmlNotepad/commit/3665603d61ba10b7827a3724e854748cb780140c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-34401 · Security Note
• https://osv.dev/vulnerability/CVE-2026-34401 · Vendor Advisory
• https://github.com/microsoft/XmlNotepad/releases/tag/2.9.0.21 · Note
• https://twitter.com/0dayPublishing/status/2039091451817021503 · Twitter Post
• https://twitter.com/CVEnew/status/2039372112528376130 · Twitter Post