Vulnerability · Published Sep 28, 2022 · Assigned by Mend
CVE-2022-32168notepad-plus-plus - DLL Hijacking
High 7.8
In plain English
A high-severity uncontrolled search path in notepad-plus-plus from notepad-plus-plus. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.8%top 44.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerable dll (UxTheme.dll) with his own dll and run arbitrary code in the context of Notepad++.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| notepad-plus-plus | notepad-plus-plus | v8.3 – before unspecifiedunspecified – through v8.4.4 |
Weakness: CWE-427 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H