CVE-2025-56383

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2025-56383", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-02-26T17:47:55.453Z", "dateReserved": "2025-08-16T00:00:00.000Z", "datePublished": "2025-09-26T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2025-11-19T14:32:21.646Z"}, "descriptions": [{"lang": "en", "value": "Notepad++ v8.8.3 has a DLL hijacking vulnerability, which can replace the original DLL file to execute malicious code. NOTE: this is disputed by multiple parties because the behavior only occurs when a user installs the product into a directory tree that allows write access by arbitrary unprivileged users."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/notepad-plus-plus/notepad-plus-plus"}, {"url": "https://github.com/zer0t0/CVE-2025-56383-Proof-of-Concept"}, {"url": "https://github.com/zer0t0/CVE-2025-56383-Proof-of-Concept/issues/1"}, {"url": "https://www.vicarius.io/vsociety/posts/cve-2025-56383-detect-notepad-vulnerability"}, {"url": "https://www.vicarius.io/vsociety/posts/cve-2025-56383-mitigate-notepad-vulnerability"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}], "tags": ["disputed"]}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-56383", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-09-30T03:55:10.161379Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-427", "description": "CWE-427 Uncontrolled Search Path Element"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T17:47:55.453Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-56383", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-09-30T03:55:10.161379Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-427", "description": "CWE-427 Uncontrolled Search Path Element"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-26T20:39:26.596Z"}}], "cna": {"tags": ["disputed"], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/notepad-plus-plus/notepad-plus-plus"}, {"url": "https://github.com/zer0t0/CVE-2025-56383-Proof-of-Concept"}, {"url": "https://github.com/zer0t0/CVE-2025-56383-Proof-of-Concept/issues/1"}, {"url": "https://www.vicarius.io/vsociety/posts/cve-2025-56383-detect-notepad-vulnerability"}, {"url": "https://www.vicarius.io/vsociety/posts/cve-2025-56383-mitigate-notepad-vulnerability"}], "descriptions": [{"lang": "en", "value": "Notepad++ v8.8.3 has a DLL hijacking vulnerability, which can replace the original DLL file to execute malicious code. NOTE: this is disputed by multiple parties because the behavior only occurs when a user installs the product into a directory tree that allows write access by arbitrary unprivileged users."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2025-11-19T14:32:21.646Z"}}}, "cveMetadata": {"cveId": "CVE-2025-56383", "state": "PUBLISHED", "dateUpdated": "2026-02-26T17:47:55.453Z", "dateReserved": "2025-08-16T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2025-09-26T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "cveTags": [{"sourceIdentifier": "cve@mitre.org", "tags": ["disputed"]}], "descriptions": [{"lang": "en", "value": "Notepad++ v8.8.3 has a DLL hijacking vulnerability, which can replace the original DLL file to execute malicious code. NOTE: this is disputed by multiple parties because the behavior only occurs when a user installs the product into a directory tree that allows write access by arbitrary unprivileged users."}, {"lang": "es", "value": "Notepad++ v8.8.3 tiene una vulnerabilidad de secuestro de DLL, que puede reemplazar el archivo DLL original para ejecutar c\u00f3digo malicioso. NOTA: esto es disputado por m\u00faltiples partes porque el comportamiento solo ocurre cuando un usuario instala el producto en un \u00e1rbol de directorios que permite acceso de escritura por usuarios no privilegiados arbitrarios."}], "id": "CVE-2025-56383", "lastModified": "2026-11-05T23:10:00.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-56383", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-09-30T03:55:10.161379Z", "version": "2.0.3"}}]}, "published": "2025-09-26T18:15:36.490", "references": [{"source": "cve@mitre.org", "url": "https://github.com/notepad-plus-plus/notepad-plus-plus"}, {"source": "cve@mitre.org", "url": "https://github.com/zer0t0/CVE-2025-56383-Proof-of-Concept"}, {"source": "cve@mitre.org", "url": "https://github.com/zer0t0/CVE-2025-56383-Proof-of-Concept/issues/1"}, {"source": "cve@mitre.org", "url": "https://www.vicarius.io/vsociety/posts/cve-2025-56383-detect-notepad-vulnerability"}, {"source": "cve@mitre.org", "url": "https://www.vicarius.io/vsociety/posts/cve-2025-56383-mitigate-notepad-vulnerability"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-427"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"created": "2025-09-29T09:31:13.316288+00:00", "updated": "2025-09-29T09:31:13.316344+00:00", "vendors": ["notepad++", "notepad++$PRODUCT$notepad++"]}