Notepad++ DLL Hijack Flaw Lets Attackers Run Malicious Code

Security researchers have identified a critical DLL hijacking vulnerability in Notepad++ version 8.8.3, tracked as CVE-2025-56383. The flaw allows attackers to execute arbitrary code by replacing legitimate DLLs in the application’s plugin directory with malicious versions that expose the same exports. It specifically targets the Notepad++ plugin system, notably the NppExport.dll file in Notepad++\plugins\NppExport\.

Attackers can craft a DLL with identical export functions that forwards calls to the original DLL while also running harmful code. Successful exploitation requires local file system access and the ability to modify files within the Notepad++ installation directory, limiting the scope to scenarios where an attacker already has some access. The CVSS score is 7.8 (High), with a local attack vector of low complexity and low privileges, and a proof-of-concept is available on GitHub from zer0t0.

No official patch has been released yet, and users are advised to exercise caution with unofficial Notepad++ sources and to verify the integrity of plugin files and restrict write access to the installation directory.