CVE-2026-38972: Notepad3 DLL Search-Order Hijacking Vulnerability

Technical summary

The vulnerability exists in Notepad3's About-dialog code path (src/Notepad3.c), where a call to LoadLibrary(L"MSFTEDIT.DLL") uses an unqualified DLL name rather than an absolute path. This unsafe pattern invokes the standard Windows DLL search order, which includes the application directory before system directories in many contexts. CWE-427 (Uncontrolled Search Path Element) describes this class of flaw. An attacker with local file-system write access can exploit this by dropping a crafted MSFTEDIT.DLL into a preferred search location (e.g., the application's install directory or the user's current working directory). Upon opening the About dialog, Notepad3 will load and execute the attacker-controlled DLL in the application's process context, gaining the same privileges as the user running Notepad3.

Business impact

Users of Notepad3 who receive or download files from untrusted sources face code-execution risk if they interact with those files in a directory where an attacker has planted a malicious DLL. For enterprise environments, this poses a local privilege-escalation and lateral-movement vector if an attacker gains initial file-system write access on a shared system or removable media. Notepad3 is commonly used for quick text editing and administrative tasks, increasing exposure in high-value workflows. Compromised instances could enable credential theft, malware persistence, or data exfiltration under the victim's account privileges.

Affected systems

Notepad3 versions through 6.25.822.1 are affected. Rizone Software maintains Notepad3 as a lightweight Notepad replacement for Windows. All deployment scenarios—personal use, organizational deployments, portable installations—are vulnerable if users interact with the About dialog. The flaw is present in the application's core executable, so vulnerability scope spans all Windows platforms supported by the affected Notepad3 versions (typically Windows 7 and later).

Exploitability

Exploitability is straightforward for attackers with local file-system access. The attack requires user interaction (opening the About dialog), but this is a common operation—many users explore application menus or check version information routinely. No special privileges, network access, or advanced techniques are needed; a simple DLL replacement suffices. The barrier to exploitation is low, though the attack surface is limited to scenarios where an attacker can write files to a location Notepad3 searches during DLL loading. This makes the vulnerability particularly concerning in shared-system environments, removable-media scenarios, or situations where users download and extract files into application directories.

Remediation

Update Notepad3 to a version released after 6.25.822.1 that addresses DLL loading. Verify the fixed version against the Rizone Software advisory or release notes to confirm the DLL search-order hijacking has been patched. The fix typically involves using the full path or a safe API call (such as LoadLibraryEx with LOAD_LIBRARY_SEARCH_SYSTEM32) to load system libraries. Users should also practice defensive file handling: avoid extracting or downloading untrusted archives into application directories, and review directory permissions to restrict who can create or modify files in application folders.

Patch guidance

Check Rizone Software's official website or GitHub repository for Notepad3 updates released after July 2, 2026. Deployment teams should test the patched version in a non-production environment before rolling out organization-wide. For portable or non-installer deployments, ensure the updated executable is deployed to all affected systems. Consider automating updates through configuration management if Notepad3 is widely deployed. Until patches are available and deployed, restrict file-creation permissions in Notepad3 directories and educate users to avoid extracting untrusted archives into application folders.

Detection guidance

Monitor file-system activity in Notepad3 installation directories for unexpected DLL creation or modification, particularly MSFTEDIT.DLL. Endpoint detection and response (EDR) tools can flag unsigned or out-of-place DLLs loaded by Notepad3. Log application-level execution events if available. On shared or multi-user systems, audit directory permissions on application folders to identify overly permissive write access. Behavioral monitoring for unusual child processes spawned by Notepad3 may indicate successful exploitation, though sophisticated attacks may avoid spawning obvious child processes.

Why prioritize this

Although this vulnerability requires local access and user interaction, its high CVSS score (7.8) reflects the severity of arbitrary code execution. Prioritize patching in environments where Notepad3 is deployed on multi-user systems, shared workstations, or systems handling untrusted files. Lower priority for air-gapped or single-user systems with restricted file-system permissions, but still address to close the attack surface.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: Local attack vector (AV:L), low attack complexity (AC:L), no privilege requirement (PR:N), and requirement for user interaction (UI:R). The impact is severe: high confidentiality, integrity, and availability impact (C:H/I:H/A:H) because successful exploitation grants arbitrary code execution. The score appropriately balances the practical barrier (local access, user action) against the catastrophic outcome (code execution under user privileges). This is not a critical remote code execution, but it is a significant local code-execution flaw.

Frequently asked questions