Loading vulnerability…
Disputed DLL Hijacking in Notepad++ 8.8.3
CVE-2025-56383 describes disputed DLL hijacking behavior in Notepad++ 8.8.3. An attacker with write access to the application's installation tree can replace a DLL or plugin subsequently loaded by Notepad++, causing attacker-controlled code to execute within the application process. The behavior requires installation into a directory tree writable by arbitrary unprivileged users. Multiple parties, including the Notepad++ developers, dispute its classification as a vulnerability because loading DLL-based plugins is intended functionality and exploitation depends on insecure installation permissions.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution with the privileges of the Notepad++ process. Privilege escalation is possible if a higher-privileged user launches an installation whose DLLs can be modified by a lower-privileged attacker; elevated or SYSTEM execution is not an inherent outcome. Malicious code can compromise data and perform further actions permitted by the process security context.
If you can’t patch tonight, do this now.
Restrict write access to the Notepad++ installation tree, plugin directories, and other DLL-loading locations. Avoid running copies from shared or otherwise untrusted writable directories, particularly with elevated privileges. Monitor for unauthorized plugin changes and reject repackaged application bundles from untrusted sources.
Patch, then assume compromise.
Install or redeploy Notepad++ from a trusted distribution into a directory protected against modification by unprivileged users, and remove unauthorized DLLs or plugins. A confirmed vendor fix or fixed release specifically addressing CVE-2025-56383 is not established; the developers dispute the issue and reportedly do not plan to change the plugin-loading behavior. General recommendations to update Notepad++ should not be treated as confirmation that a particular release fixes this CVE.
1 exploit validated by Mallory's analysis.
47 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.