Notepad3 through 6.25.822.1 contains a DLL search-order hijacking vulnerability in the About-dialog code path in src/Notepad3.c. The application calls LoadLibrary(L"MSFTEDIT.DLL") with a bare DLL name, which allows a local attacker to place a malicious MSFTEDIT.DLL in the application directory or another preferred DLL search location and achieve arbitrary code execution in the context of the user when the About dialog is opened.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Rizonesoft
  • Notepad3

No data.

No data.

References
Link Providers
https://github.com/rizonesoft/Notepad3 cve-icon
https://github.com/rizonesoft/Notepad3/issues/5605 cve-icon cve-icon
https://github.com/rizonesoft/Notepad3/pull/5606 cve-icon
History

Thu, 09 Jul 2026 02:00:00 +0000

Type Values Removed Values Added
Title DLL Search-Order Hijacking in Notepad3 Leading to Local Arbitrary Code Execution

Wed, 08 Jul 2026 01:30:00 +0000

Type Values Removed Values Added
Title DLL Hijacking via About Dialog in Notepad3

Tue, 07 Jul 2026 09:00:00 +0000

Type Values Removed Values Added
Title DLL Hijacking via About Dialog in Notepad3

Tue, 07 Jul 2026 01:30:00 +0000

Type Values Removed Values Added
Title DLL Hijacking Vulnerability in Notepad3’s About Dialog
Weaknesses CWE-114

Mon, 06 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-427
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 06 Jul 2026 02:45:00 +0000

Type Values Removed Values Added
Title DLL Hijacking Vulnerability in Notepad3’s About Dialog
Weaknesses CWE-114

Sun, 05 Jul 2026 18:45:00 +0000

Type Values Removed Values Added
Title DLL Hijacking in Notepad3 About Dialog Allows Local Code Execution
Weaknesses CWE-114

Sun, 05 Jul 2026 10:45:00 +0000

Type Values Removed Values Added
Title DLL Hijacking in Notepad3 About Dialog Allows Local Code Execution
Weaknesses CWE-114

Sat, 04 Jul 2026 21:15:00 +0000

Type Values Removed Values Added
Title DLL Search-Order Hijacking in Notepad3 About Dialog
Weaknesses CWE-114

Sat, 04 Jul 2026 10:45:00 +0000

Type Values Removed Values Added
Title DLL Search-Order Hijacking in Notepad3 About Dialog
Weaknesses CWE-114

Fri, 03 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Title Local DLL Hijacking Allows Arbitrary Code Execution in Notepad3 About Dialog
Weaknesses CWE-114

Fri, 03 Jul 2026 04:00:00 +0000

Type Values Removed Values Added
Title Local DLL Hijacking Allows Arbitrary Code Execution in Notepad3 About Dialog
Weaknesses CWE-114

Thu, 02 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
First Time appeared Rizonesoft
Rizonesoft notepad3
Vendors & Products Rizonesoft
Rizonesoft notepad3

Thu, 02 Jul 2026 21:15:00 +0000

Type Values Removed Values Added
Description Notepad3 through 6.25.822.1 contains a DLL search-order hijacking vulnerability in the About-dialog code path in src/Notepad3.c. The application calls LoadLibrary(L"MSFTEDIT.DLL") with a bare DLL name, which allows a local attacker to place a malicious MSFTEDIT.DLL in the application directory or another preferred DLL search location and achieve arbitrary code execution in the context of the user when the About dialog is opened.
References
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2026-07-02T00:00:00.000Z

Updated: 2026-07-06T14:42:52.329Z

Reserved: 2026-04-06T00:00:00.000Z

Link: CVE-2026-38972

cve-icon Vulnrichment

Updated: 2026-07-06T14:41:50.532Z

cve-icon NVD

No data.

cve-icon Redhat

No data.