CVE-2025-49144
BaseFortify
Publication date: 2025-06-23
Last updated on: 2025-10-23
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Affected Vendors & Products
| Vendor | Product | Version |
|---|---|---|
| notepad++ | notepad++ | to 8.8.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-427 | The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. |
| CWE-276 | During installation, installed file permissions are set to allow anyone to modify those files. |
| CWE-272 | The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-49144 is a local privilege escalation vulnerability in the Notepad++ v8.8.1 Windows installer caused by an uncontrolled executable search path, also known as binary planting. The installer searches for executable dependencies in the current working directory without verifying their legitimacy. An attacker can place a malicious executable in the same directory as the installer (commonly the Downloads folder). When the user runs the installer, it inadvertently executes the malicious executable with SYSTEM-level privileges, allowing the attacker to gain full system control. This happens because the installer calls system utilities like regsvr32.exe without specifying their absolute paths, enabling side-loading of malicious binaries. [3]
How can this vulnerability impact me? :
This vulnerability allows an attacker to escalate their privileges from a low-privileged user to SYSTEM-level privileges on the affected machine. By tricking a user into running the vulnerable installer from a directory containing a malicious executable, the attacker can execute arbitrary code with the highest system privileges. This can lead to full system compromise, including arbitrary code execution, data theft, and lateral movement within a network. [3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves monitoring for suspicious executable files placed in directories where the Notepad++ installer is run, such as the Downloads folder. One can check for unexpected or rogue executables like regsvr32.exe in these directories. Additionally, using tools like Process Monitor to trace the installer execution can reveal attempts to load executables from insecure paths. Commands to list suspicious executables in the installer directory could include: 1) PowerShell: Get-ChildItem -Path $env:USERPROFILE\Downloads -Filter regsvr32.exe -Recurse 2) Command Prompt: dir %USERPROFILE%\Downloads\regsvr32.exe /s 3) Using Process Monitor (procmon) to filter for Notepad++ installer process and monitor file system activity for executable loads. These methods help identify if malicious executables are present or being loaded during installation. [3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include: 1) Avoid running the Notepad++ v8.8.1 or earlier installer from untrusted or common user directories such as Downloads. 2) Upgrade to Notepad++ version 8.8.2 or later, where the installer uses absolute paths for system executables, preventing this vulnerability. 3) Ensure that no malicious executables exist in the directories where the installer is run by scanning and removing suspicious files. 4) Educate users to avoid running installers from directories that may contain untrusted executables. 5) Consider applying application whitelisting or execution policies to prevent unauthorized executables from running with elevated privileges. These steps reduce the risk of privilege escalation via binary planting. [3, 2]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows local privilege escalation to SYSTEM-level privileges, enabling an attacker to gain full system control, which could lead to unauthorized access, data theft, and lateral movement within a network. Such unauthorized access and potential data breaches could negatively impact compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and system integrity. Therefore, exploitation of this vulnerability could result in violations of these regulations due to compromised confidentiality, integrity, and availability of data and systems. [2]