EUVD-2025-19601CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Tags
Description
Notepad++ is a free and open-source source code editor. In versions 8.8.1 and prior, a privilege escalation vulnerability exists in the Notepad++ v8.8.1 installer that allows unprivileged users to gain SYSTEM-level privileges through insecure executable search paths. An attacker could use social engineering or clickjacking to trick users into downloading both the legitimate installer and a malicious executable to the same directory (typically Downloads folder - which is known as Vulnerable directory). Upon running the installer, the attack executes automatically with SYSTEM privileges. This issue has been fixed and will be released in version 8.8.2.
Analysis
CVE-2025-49144 is a privilege escalation vulnerability in Notepad++ v8.8.1 and earlier that exploits insecure executable search paths in the installer to allow unprivileged local users to execute arbitrary code with SYSTEM privileges. An attacker can leverage social engineering to colocate a malicious executable with the legitimate installer in a writable directory (e.g., Downloads), and upon installer execution, the malicious payload runs with elevated privileges. The vulnerability is fixed in version 8.8.2.
Technical Context
The vulnerability stems from CWE-272 (Improper Privilege Management), specifically an insecure DLL/executable search path issue in the Notepad++ installer. Windows executables, including installers, perform dynamic linking and may search for dependencies in the current working directory before system paths. When the Notepad++ installer is executed from a user-writable directory (Downloads, Desktop, etc.), it can be manipulated to load a malicious executable with the same name as an expected library or dependency. Since the installer typically runs with elevated privileges during installation, any code loaded through this path executes with SYSTEM-level privileges. The affected product is Notepad++ (CPE: cpe:2.3:a:notepad++:notepad++:*:*:*:*:*:*:*:*) versions through 8.8.1. The root cause is improper validation of executable search paths and failure to use absolute paths or secure loading mechanisms.
Affected Products
Notepad++ (8.8.1 and all prior versions)
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today