CVE-2026-38972

Name of the Vulnerable Software and Affected Versions Notepad3 versions prior to 6.25.822.2

Description A DLL search-order hijacking issue exists in the About-dialog code path within src/Notepad3.c. The application uses the LoadLibrary() function to load MSFTEDIT.DLL using a bare name. This allows a local attacker to place a malicious version of the DLL in the application directory or other search locations, leading to arbitrary code execution in the user context when the About dialog is opened.

Recommendations Update Notepad3 to a version newer than 6.25.822.1.