CVE‑2025‑49144 – Local Privilege Escalation in Notepad++
CVE‑2025‑49144: Privilege Escalation Threat Emerges in Popular Text Editor
CVE‑2025‑49144 is a newly disclosed privilege escalation vulnerability affecting Notepad++ v8.8.1. Despite being a local attack, it poses a serious risk due to ease of exploitation and availability of proof-of-concept code in the wild.
| Field | Value |
| Product | Notepad++ v8.8.1 |
| CVSS v3.1 | 7.3 (High) |
| Exploit | Local attacker can escalate to NT AUTHORITY\SYSTEM via binary planting |
| PoC | Proof-of-concept code is already in circulation :contentReference[oaicite:1]{index=1} |
Why It Matters
The vulnerability allows a local user or compromised account to gain full system control—high impact for desktops and developer workstations.
Notepad++ is widely used by sysadmins and developers, making it a common target.
The released PoC lowers the barrier for exploitation, increasing urgency.
Recommended Actions
Update Immediately to the latest patched version of Notepad++.
Restrict write-permissions to Notepad++ directories on shared systems.
Monitor privileged process launches originating from Notepad++ (EDR or SIEM).
Key Takeaway
Local privileges can be just as dangerous as remote exploits—particularly for trusted applications. Treat released PoCs as an urgent indicator and act accordingly.
