CVE-2022-32168: Notepad++ DLL Hijacking RCE Vulnerability

CVE-2022-32168 Overview

CVE-2022-32168 is a DLL hijacking vulnerability affecting Notepad++ versions 8.4.1 and earlier. The vulnerability allows an attacker to replace a vulnerable DLL file (UxTheme.dll) with a malicious DLL, enabling arbitrary code execution within the context of the Notepad++ application. This type of attack exploits the Windows DLL search order mechanism, where applications load DLLs from predictable locations without proper validation.

Critical Impact

Attackers can achieve arbitrary code execution by placing a malicious DLL in the application directory, potentially leading to complete system compromise when a user launches Notepad++.

Affected Products

• Notepad++ versions 8.4.1 and earlier
• All Windows installations running vulnerable Notepad++ versions
• Systems where users have write access to the Notepad++ installation directory

Discovery Timeline

• 2022-09-28 - CVE-2022-32168 published to NVD
• 2025-05-21 - Last updated in NVD database

Technical Details for CVE-2022-32168

Vulnerability Analysis

This vulnerability stems from CWE-427 (Uncontrolled Search Path Element), a class of weaknesses where an application searches for critical resources such as libraries or executables in locations that might be under the control of untrusted parties. In this case, Notepad++ used the standard LoadLibrary() function to load DLLs like UxTheme.dll and DBGHELP.DLL without specifying a secure search path.

When a user executes Notepad++, the application attempts to load these DLLs following the standard Windows DLL search order. If an attacker has placed a malicious DLL with the same name in a directory that is searched before the legitimate system directory, the malicious DLL will be loaded instead, executing arbitrary code with the privileges of the Notepad++ process.

Root Cause

The root cause of this vulnerability is the use of the insecure LoadLibrary() API without proper path restrictions. The vulnerable code loaded UxTheme.dll and DBGHELP.DLL using:

_hUXTheme = ::LoadLibrary(TEXT("uxtheme.dll"));
HMODULE hDll = ::LoadLibrary( TEXT("DBGHELP.DLL") );

This approach does not restrict the DLL search path, allowing Windows to search in multiple locations including the application's current directory, which may be writable by an attacker.

Attack Vector

The attack vector is local, requiring the attacker to have write access to the Notepad++ installation directory or to a location in the DLL search path. The attack flow involves:

1. Attacker identifies the vulnerable DLL loading behavior in Notepad++
2. Attacker creates a malicious DLL named UxTheme.dll or DBGHELP.DLL
3. Attacker places the malicious DLL in the Notepad++ installation directory
4. User launches Notepad++, which loads the malicious DLL instead of the legitimate system DLL
5. Malicious code executes with the user's privileges

The official patch addresses this by using LoadLibraryEx() with the LOAD_LIBRARY_SEARCH_SYSTEM32 flag:

// Security patch in PowerEditor/src/Parameters.cpp
// Before (vulnerable):
_hUXTheme = ::LoadLibrary(TEXT("uxtheme.dll"));

// After (secure):
_hUXTheme = ::LoadLibraryEx(TEXT("uxtheme.dll"), nullptr, LOAD_LIBRARY_SEARCH_SYSTEM32);

Source: GitHub Commit 85d7215d9b3e0d5a8433fc31aec4f2966821051e

// Security patch in PowerEditor/src/MISC/Exception/MiniDumper.cpp
// Before (vulnerable):
HMODULE hDll = ::LoadLibrary( TEXT("DBGHELP.DLL") );

// After (secure):
HMODULE hDll = ::LoadLibraryEx(TEXT("DBGHELP.DLL"), nullptr, LOAD_LIBRARY_SEARCH_SYSTEM32);

Source: GitHub Commit 85d7215d9b3e0d5a8433fc31aec4f2966821051e

Detection Methods for CVE-2022-32168

Indicators of Compromise

• Presence of UxTheme.dll or DBGHELP.DLL files in the Notepad++ installation directory (these should only exist in the Windows System32 directory)
• Unexpected DLL files with suspicious timestamps in the Notepad++ application folder
• Notepad++ process loading DLLs from non-standard paths visible in process monitoring tools
• Unusual network connections or child processes spawned by notepad++.exe

Detection Strategies

• Monitor DLL loading events for notepad++.exe using Windows Event Tracing or Sysmon
• Implement file integrity monitoring on the Notepad++ installation directory
• Use application whitelisting solutions to prevent unauthorized DLL loading
• Deploy endpoint detection rules that alert on DLLs loaded from application directories that should originate from System32

Monitoring Recommendations

• Configure SentinelOne Deep Visibility to track DLL load events for common applications like Notepad++
• Create custom detection rules for LoadLibrary calls loading Windows system DLLs from non-system paths
• Implement behavioral monitoring to detect code execution originating from unexpected DLL loads
• Review process ancestry chains for Notepad++ to identify suspicious parent-child relationships

How to Mitigate CVE-2022-32168

Immediate Actions Required

• Update Notepad++ to version 8.4.2 or later immediately
• Audit Notepad++ installation directories for any unexpected DLL files
• Review system access controls to ensure users cannot write to application installation directories
• Deploy endpoint protection solutions capable of detecting DLL hijacking attempts

Patch Information

The Notepad++ development team has addressed this vulnerability in the official security patch. The fix replaces insecure LoadLibrary() calls with LoadLibraryEx() using the LOAD_LIBRARY_SEARCH_SYSTEM32 flag, which forces Windows to load the specified DLLs exclusively from the System32 directory, preventing DLL hijacking attacks.

Organizations should update to the latest version of Notepad++ through their standard software update processes or download directly from the official Notepad++ website.

Workarounds

• Restrict write permissions on the Notepad++ installation directory to administrators only
• Use software restriction policies or AppLocker to prevent execution of DLLs from the Notepad++ directory
• Deploy application control solutions that whitelist legitimate DLL locations
• Consider running Notepad++ in a sandboxed environment if immediate patching is not possible

# Restrict write permissions on Notepad++ installation directory (Windows)
icacls "C:\Program Files\Notepad++" /inheritance:r /grant:r "Administrators:(OI)(CI)F" /grant:r "SYSTEM:(OI)(CI)F" /grant:r "Users:(OI)(CI)RX"