Read the docs
TI-2025-31224 Aliases CVE-2025-49144

Notepad++ Privilege Escalation in Installer via Uncontrolled Executable Search Path

Priority LOW 35CWE-272Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-427.

Summary

Notepad++ is a free and open-source source code editor. In versions 8.8.1 and prior, a privilege escalation vulnerability exists in the Notepad++ v8.8.1 installer that allows unprivileged users to gain SYSTEM-level privileges through insecure executable search paths. An attacker could use social engineering or clickjacking to trick users into downloading both the legitimate installer and a malicious executable to the same directory (typically Downloads folder - which is known as Vulnerable directory). Upon running the installer, the attack executes automatically with SYSTEM privileges. This issue has been fixed and will be released in version 8.8.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00658 51st percentileScored 2026-11-07
Fix Fixed notepad-plus-plus (notepad-plus-plus): 8.8.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
notepad-plus-plusnotepad-plus-plusbefore 8.8.28.8.2Patch availableCNA
  • notepad-plus-plus Vendornotepad-plus-plus Affected before 8.8.2 Fixed in 8.8.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:notepad-plus-plus:notepad\+\+:*:*:*:*:*:*:*:*——notepad-plus-plus
  • cpe:2.3:a:notepad-plus-plus:notepad\+\+:*:*:*:*:*:*:*:* Versions — — ·notepad-plus-plus

Remediation

  • Fix · CNA notepad-plus-plus (notepad-plus-plus) Fixed in 8.8.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-49144
  2. 2026-10-11 EPSS moved to the 50th–90th percentile

References

Other 3

  • TI-2025-14195 Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification KEVCVSS 4.0HIGH 7.7
  • TI-2026-58566 Notepad++: Stack Buffer Overflow in Plugin Lexer Loading via Unchecked GetLexerCount() Return Value CVSS 3.1HIGH 8.6
  • TI-2026-58869 Notepad++: Stack Buffer Overflow in `NppParameters::writeSession` via overlong session path CVSS 3.1HIGH 7.8
  • TI-2026-54091 Notepad++ “Run by system” executes *.txt.cmd when user selected *.txt (target confusion → command execution) CVSS 3.1HIGH 7.8
  • TI-2026-36070 Notepad++: Arbitrary Code Execution via shortcuts.xml UserCommand Injection CVSS 3.1HIGH 7.8
  • TI-2026-36048 Notepad++: Arbitrary Code Execution via config.xml commandLineInterpreter CVSS 3.1HIGH 7.8
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences