CVE-2026-38972 Other in n/a
A local attacker can achieve arbitrary code execution by placing a malicious DLL in the application directory, exploiting a DLL search-order hijacking vulnerability in Notepad3.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-38972?
CVE-2026-38972 is a high-severity vulnerability in n/a, published on 2 Jul 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Notepad3 through 6.25.822.1 contains a DLL search-order hijacking vulnerability in the About-dialog code path in src/Notepad3.c. The application calls LoadLibrary(L"MSFTEDIT.DLL") with a bare DLL name, which allows a local attacker to place a malicious MSFTEDIT.DLL in the application directory or another preferred DLL search location and achieve arbitrary code execution in the context of the user when the About dialog is opened.
Weakness: CWE-427
Which versions are affected by CVE-2026-38972?
It affects 1 product.
Products include Rizonesoft Notepad3.
How do I fix CVE-2026-38972?
No fix has been published for CVE-2026-38972 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-38972 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-38972 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-gmg7-w8wv-j7v2.