CVE-2022-32168 notepad-plus-plus - DLL Hijacking

2022-09-2100:00:00

CWE-427

Mend

www.cve.org

notepad++

vulnerability

dll hijacking

arbitrary code execution

uxtheme.dll

0.001 Low

EPSS

Percentile

31.9%

JSON

Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerable dll (UxTheme.dll) with his own dll and run arbitrary code in the context of Notepad++.

CNA Affected

[
  {
    "product": "notepad-plus-plus",
    "vendor": "notepad-plus-plus",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "v8.3",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "v8.4.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]