CVE‑2025‑49144 – Local Privilege Escalation in Notepad++
Dave Hall
CVE‑2025‑49144: Privilege Escalation Threat Emerges in Popular Text Editor
CVE‑2025‑49144 is a newly disclosed privilege escalation vulnerability affecting Notepad++ v8.8.1. Despite being a local attack, it poses a serious risk due to ease of exploitation and availability of proof-of-concept code in the wild.
| Field | Value |
| Product | Notepad++ v8.8.1 |
| CVSS v3.1 | 7.3 (High) |
| Exploit | Local attacker can escalate to NT AUTHORITY\SYSTEM via binary planting |
| PoC | Proof-of-concept code is already in circulation :contentReference[oaicite:1]{index=1} |
Why It Matters
The vulnerability allows a local user or compromised account to gain full system control—high impact for desktops and developer workstations.
Notepad++ is widely used by sysadmins and developers, making it a common target.
The released PoC lowers the barrier for exploitation, increasing urgency.
Recommended Actions
Update Immediately to the latest patched version of Notepad++.
Restrict write-permissions to Notepad++ directories on shared systems.
Monitor privileged process launches originating from Notepad++ (EDR or SIEM).
Key Takeaway
Local privileges can be just as dangerous as remote exploits—particularly for trusted applications. Treat released PoCs as an urgent indicator and act accordingly.
Subscribe to my newsletter
Read articles from Dave Hall directly inside your inbox. Subscribe to the newsletter, and don't miss out.
Written by