DLL Hijacking Flaw (CVE-2025-56383) Found in Notepad++, Allowing Arbitrary Code Execution, PoC Available

A newly disclosed vulnerability in Notepad++ v8.8.3 has been assigned CVE-2025-56383 and is rated CVSS 6.5, allowing attackers to hijack Notepad++’s DLL loading process and potentially execute arbitrary code. According to the disclosure, Notepad++ v8.8.3 has a DLL hijacking vulnerability that can replace the original DLL file to run malicious code. The attack works by replacing a trusted DLL, such as NppExport.dll, with a forged version so that Notepad++ executes the attacker’s code when the program launches.

A working proof-of-concept has been released on GitHub, complete with demonstration images of the attack chain, showing the forged NppExport.dll executing malicious code while forwarding calls to the original DLL. The advisory notes that exploitation requires local access or the ability to drop malicious DLLs in the Notepad++ installation path, though the flaw raises the risk of persistence and privilege escalation for attackers.