CVE-2025-491447.3HighCWE-272

CVE-2025-49144: Notepad++ Privilege Escalation in Installer via Uncontrolled Executable Search Path

notepad-plus-plus

Affected: notepad-plus-plus · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.7%probability of exploitation in the next 30 days

52nd percentile

050100

Higher than 52% of scored CVEs

7.3HighCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

Notepad++ is a free and open-source source code editor. In versions 8.8.1 and prior, a privilege escalation vulnerability exists in the Notepad++ v8.8.1 installer that allows unprivileged users to gain SYSTEM-level privileges through insecure executable search paths. An attacker could use social engineering or clickjacking to trick users into downloading both the legitimate installer and a malicious executable to the same directory (typically Downloads folder - which is known as Vulnerable directory). Upon running the installer, the attack executes automatically with SYSTEM privileges. This issue has been fixed and will be released in version 8.8.2.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

notepad-plus-plus · notepad-plus-plus< 8.8.2

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Least Privilege Violation · Access Control
Vendor: notepad-plus-plus
Published: June 2025
Band: Unlikely (under 1%), June 2025

CoverageNo articles yet

No CyberSIXT article names CVE-2025-49144 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.