CVE-2026-38972 describes a DLL search-order hijacking vulnerability in Notepad3 through version 6.25.822.1. The vulnerability exists because the application calls LoadLibrary with the bare DLL name "MSFTEDIT.DLL" in the About dialog code path (src/Notepad3.c). This behavior enables a local attacker to place a malicious MSFTEDIT.DLL in the application directory or another preferred DLL search location. When the About dialog is opened, the malicious DLL is loaded instead of the legitimate system DLL, resulting in arbitrary code execution in the context of the user.

A local attacker can achieve arbitrary code execution with the privileges of the user running Notepad3 by exploiting the DLL search-order hijacking vulnerability. This could lead to compromise of the user's environment or execution of malicious code without requiring elevated privileges. There is no indication of remote exploitation or known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid running untrusted code in the same directory as Notepad3 or opening the About dialog in untrusted environments. Restricting write permissions to the application directory can reduce the risk of placing malicious DLLs. Monitor the vendor's official channels for updates and patches addressing this vulnerability.