Security Research

CVE-2025-56386 Notepad++ DLL Hijacking: v8.8.3 DLL Search Order and CWD Fatal Combination

#Vulnerability Analysis#Code Audit#Malware
CVE-2025-56386 Notepad++ DLL Hijacking: v8.8.3 DLL Search Order and CWD Fatal Combination

Notepad++ uses Windows’ default DLL search order (including CWD) when loading DLLs, but does not use SetDefaultDllDirectories with LOAD_LIBRARY_SEARCH to limit safe paths — attackers place a malicious same-named DLL in the CWD where the user opens a malicious document, and Notepad++ preferentially loads the CWD’s malicious DLL on startup, completing RCE under user privileges.

Unlock to view this content.