Notepad3
CVE-2026-38972
HIGH
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local DLL planting (AV:L) with trivial complexity (AC:L), no prior privileges but victim must open the About dialog (UI:R); loaded code inherits full user-context C/I/A impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Notepad3 through 6.25.822.1 contains a DLL search-order hijacking vulnerability in the About-dialog code path in src/Notepad3.c. The application calls LoadLibrary(L"MSFTEDIT.DLL") with a bare DLL name, which allows a local attacker to place a malicious MSFTEDIT.DLL in the application directory or another preferred DLL search location and achieve arbitrary code execution in the context of the user when the About dialog is opened.
AnalysisAI
Local code execution in Notepad3 (versions through 6.25.822.1) arises from an insecure LoadLibrary(L"MSFTEDIT.DLL") call in the About-dialog path within src/Notepad3.c. Because the DLL is loaded by bare name, an attacker who can drop a malicious MSFTEDIT.DLL into the application directory or an earlier search-order location runs arbitrary code as the current user once that user opens the About dialog. No public exploit identified at time of analysis, and EPSS is low at 0.18% (8th percentile), consistent with a local, user-interaction-dependent flaw rather than a mass-exploitation target.
Technical ContextAI
The root cause is CWE-427 (Uncontrolled Search Path Element), a classic Windows DLL search-order hijacking issue. MSFTEDIT.DLL is the Microsoft Rich Edit control library, normally resident in the System32 directory; calling LoadLibrary with only the module name (no absolute path and without a safe search flag such as LOAD_LIBRARY_SEARCH_SYSTEM32) causes Windows to walk its default DLL search order, which historically includes the directory of the loading executable before System32. If Notepad3.exe is launched from a directory an attacker can write to (a Downloads folder, a shared network path, a portable-app directory), a planted MSFTEDIT.DLL is loaded in preference to the legitimate system copy. The affected code path is the About dialog handler in src/Notepad3.c of the Rizonesoft Notepad3 editor.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - the corrective change is tracked in https://github.com/rizonesoft/Notepad3/pull/5606 against issue https://github.com/rizonesoft/Notepad3/issues/5605, but no tagged release version is present in the provided data, so upgrade to the first Notepad3 build that incorporates PR #5606 (verify at https://github.com/rizonesoft/Notepad3). The proper code-level fix is to load MSFTEDIT.DLL with an absolute System32 path or use LoadLibraryEx with LOAD_LIBRARY_SEARCH_SYSTEM32 / SetDefaultDllDirectories. As compensating controls until patched: install and run Notepad3 only from a protected directory such as %ProgramFiles% where standard users lack write access (trade-off: breaks portable/USB usage); avoid launching Notepad3.exe from user-writable or shared/network locations like Downloads or temp folders (trade-off: requires user discipline); and consider application-directory ACL hardening or AppLocker/WDAC rules to block unsigned DLL loads from those paths (trade-off: management overhead and possible false positives for other portable apps).
A vulnerability, which was classified as problematic, was found in Rizone Soft Notepad3 1.0.2.350. Rated medium severity
Out-of-bounds read vulnerability in Notepad3's Oniguruma regex engine (regcomp.C) allows local attackers with user inter
Same weakness CWE-427 – Uncontrolled Search Path Element
View allShare
External POC / Exploit Code
Leaving vuln.today