CVE-2025-56383

CVE Enrichment

CVSS: 8.4 HIGH
EPSS: 0.38%
EPSS Percentile: 31.85%
CISA KEV: Not listed

Description

Notepad++ v8.8.3 has a DLL hijacking vulnerability, which can replace the original DLL file to execute malicious code. NOTE: this is disputed by multiple parties because the behavior only occurs when a user installs the product into a directory tree that allows write access by arbitrary unprivileged users.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 27-Sep-2025 01:15
Last Modified: 17-Jun-2026 16:42
EPSS Date: 2026-10-26
CWE: CWE-427

CVSS Vector


            CVSS:3.1                            AV:L /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

References

Last enrichment sync: 27-Oct-2026 10:46
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

The researchers mention CVE-2025-56383, a DLL hijacking flaw in Notepad++ v8.8.3, the exact version used in these attacks, but note that the Notepad++ team has disputed this issue, claiming that plugin loading is UAC-0099 Uses Malicious Notepad++ Plugin to Deploy Malware in Ukraine

Malware (3)

Threat Actors (3)

MITRE ATT&CK (5)

Products (3)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.