{"id":"CVE-2025-49144","aliases":[],"cve":{"records":[{"id":"CVE-2025-49144","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2025-06-02T10:39:41.634Z","published":"2025-06-23T19:01:16.276Z","modified":"2026-11-03T22:03:05.260Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2025-06-23T19:01:16.276Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-03T22:03:05.260Z"},{"name":"CVE","role":"ADP","organizationId":"af854a3a-2127-422b-91ae-364da2661108","modified":"2025-12-24T14:46:08.689Z"}],"references":[{"url":"https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-9vx8-v79m-6m24","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/f2346ea00d5b4d907ed39d8726b38d77c8198f30","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://drive.google.com/drive/folders/11yeUSWgqHvt4Bz5jO3ilRRfcpQZ6Gvpn","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://www.vicarius.io/vsociety/posts/cve-2025-49144-detect-notepad-vulnerability","tags":[],"source":"CVE"},{"url":"https://www.vicarius.io/vsociety/posts/cve-2025-49144-mitigate-notepad-vulnerability","tags":[],"source":"CVE"},{"url":"https://www.vicarius.io/vsociety/posts/cve-2025-49144-detect-notepad-vulnerability-1","tags":[],"source":"CVE"},{"url":"https://www.vicarius.io/vsociety/posts/cve-2025-49144-mitigate-notepad-vulnerability-1","tags":[],"source":"CVE"}],"weaknesses":[{"id":"CWE-272","description":"CWE-272: Least Privilege Violation","source":"GitHub_M"},{"id":"CWE-276","description":"CWE-276: Incorrect Default Permissions","source":"GitHub_M"},{"id":"CWE-427","description":"CWE-427: Uncontrolled Search Path Element","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2025-07-01T03:55:56.996774Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Notepad++ Privilege Escalation in Installer via Uncontrolled Executable Search Path","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"Notepad++ is a free and open-source source code editor. In versions 8.8.1 and prior, a privilege escalation vulnerability exists in the Notepad++ v8.8.1 installer that allows unprivileged users to gain SYSTEM-level privileges through insecure executable search paths. An attacker could use social engineering or clickjacking to trick users into downloading both the legitimate installer and a malicious executable to the same directory (typically Downloads folder - which is known as Vulnerable directory). Upon running the installer, the attack executes automatically with SYSTEM privileges. This issue has been fixed and will be released in version 8.8.2.","score":7.3,"severity":"high","published":"2025-06-23T19:01:16.276Z","modified":"2026-11-03T22:03:05.260Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"notepad-plus-plus","name":"notepad-plus-plus","platforms":[],"versions":[{"version":"< 8.8.2","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2025-49144"}],"remediation":[],"references":["https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-9vx8-v79m-6m24","https://github.com/notepad-plus-plus/notepad-plus-plus/commit/f2346ea00d5b4d907ed39d8726b38d77c8198f30","https://drive.google.com/drive/folders/11yeUSWgqHvt4Bz5jO3ilRRfcpQZ6Gvpn","https://www.vicarius.io/vsociety/posts/cve-2025-49144-detect-notepad-vulnerability","https://www.vicarius.io/vsociety/posts/cve-2025-49144-mitigate-notepad-vulnerability","https://www.vicarius.io/vsociety/posts/cve-2025-49144-detect-notepad-vulnerability-1","https://www.vicarius.io/vsociety/posts/cve-2025-49144-mitigate-notepad-vulnerability-1"],"sources":[{"name":"CVE","id":"CVE-2025-49144","modified":"2026-11-03T22:03:05.260Z","url":"https://www.cve.org/CVERecord?id=CVE-2025-49144"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","score":7.3}],"sourceAffected":[],"observedAt":"2026-11-03T23:00:57.761Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:30:32.029Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"Notepad++ versions 8.8.1 and prior have a privilege escalation vulnerability in the installer, allowing unprivileged users to gain SYSTEM-level privileges through insecure executable search paths. An attacker with access to the victim's system could exploit this. The issue is fixed in version 8.8.2.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-03T23:21:08.381Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2025-49144"}]}}