CVE-2026-38972 describes a DLL search-order hijacking vulnerability in Notepad3 through version 6.25.822.1. The vulnerability arises because the application calls LoadLibrary with a bare DLL name ("MSFTEDIT.DLL") in the About-dialog code path. This allows a local attacker to place a malicious DLL named MSFTEDIT.DLL in the application directory or other preferred DLL search locations. When the About dialog is opened, the malicious DLL is loaded, resulting in arbitrary code execution under the context of the user running the application. The CVSS 3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

A local attacker can achieve arbitrary code execution with the privileges of the user by placing a malicious DLL in a location that is loaded by Notepad3 when the About dialog is opened. This compromises confidentiality, integrity, and availability of the affected system at the user level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid opening the About dialog in Notepad3 or run the application in a restricted environment to limit local attacker access. Monitor vendor communications for an official fix or update.