notepad-plus-plus Notepad++ up to 8.8.1 Installer least privilege violation

Summaryinfo

A vulnerability was found in notepad-plus-plus Notepad++ up to 8.8.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Installer. Such manipulation leads to least privilege violation. This vulnerability is documented as CVE-2025-49144. The attack needs to be performed locally. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in notepad-plus-plus Notepad++ up to 8.8.1. It has been rated as critical. Affected by this issue is some unknown processing of the component Installer. The manipulation with an unknown input leads to a least privilege violation vulnerability. Using CWE to declare the problem leads to CWE-272. The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Notepad++ is a free and open-source source code editor. In versions 8.8.1 and prior, a privilege escalation vulnerability exists in the Notepad++ v8.8.1 installer that allows unprivileged users to gain SYSTEM-level privileges through insecure executable search paths. An attacker could use social engineering or clickjacking to trick users into downloading both the legitimate installer and a malicious executable to the same directory (typically Downloads folder - which is known as Vulnerable directory). Upon running the installer, the attack executes automatically with SYSTEM privileges. This issue has been fixed and will be released in version 8.8.2.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2025-49144 since 06/02/2025. The exploitation is known to be easy. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1068.

The vulnerability scanner Nessus provides a plugin with the ID 240630 (Notepad++ < 8.8.2 Privelege Escalation (CVE-2025-49144)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 8.8.2 eliminates this vulnerability. Applying the patch f2346ea00d5b4d907ed39d8726b38d77c8198f30 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (240630) and EUVD (EUVD-2025-19601). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Document Reader Software

Vendor

• notepad-plus-plus

Name

• Notepad++

Version

• 8.8.0
• 8.8.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion