CVE-2026-34401

Low

No strong exploitation signal.

CVSS base

6.5 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS — probability of exploitation (30 days)

1.0%

60.9th percentile

CISA KEV

Not listed

Weakness / dates

CWE-611

Published 2026-03-31 · modified 2026-07-24

CVSS breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector	N	Network
Attack Complexity	L	Low
Privileges Required	N	None
User Interaction	R	Required
Scope	U	Unchanged
Confidentiality	H	High
Integrity	N	None
Availability	N	None

Timeline

2026-03-31 — Published (NVD)
2026-07-24 — Last modified (NVD)

Description

XML Notepad is a Windows program that provides a simple intuitive User Interface for browsing and editing XML documents. Prior to version 2.9.0.21, XML Notepad does not disable DTD processing by default which means external entities are resolved automatically. There is a well known attack related to malicious DTD files where an attacker to craft a malicious XML file that loads a DTD that causes XML Notepad to make outbound HTTP/SMB requests, potentially leaking local file contents or capturing the victim's NTLM credentials. This issue has been patched in version 2.9.0.21.

Affected

microsoft

References

Official: NVD · CVE.org