Notepad++

A severe privilege escalation vulnerability in Notepad++ version 8.8.1, designated CVE-2025-49144, allows attackers to gain SYSTEM-level privileges through binary planting. This flaw exposes millions of users to complete system compromise, posing risks of data breaches and lateral movement within networks. The flaw affects the installer, enabling local privilege escalation attacks with minimal user interaction. The widespread adoption of Notepad++, particularly in corporate environments, amplifies the potential impact. The incident highlights the need for secure software development practices and rapid response to emerging threats.

Source: https://cybersecuritynews.com/notepad-vulnerability/

TPRM report: https://scoringcyber.rankiteo.com/company/notepad-plus-plus

"id": "not301062425",
"linkid": "notepad-plus-plus",
"type": "Vulnerability",
"date": "6/2025",
"severity": "100",
"impact": "",
"explanation": "Attack threatening the organization’s existence"

{'affected_entities': [{'industry': 'Software Development',
                        'name': 'Notepad++',
                        'size': 'Substantial user base globally',
                        'type': 'Software Application'}],
 'attack_vector': 'Binary Planting',
 'date_detected': 'May 5, 2025',
 'description': 'A severe privilege escalation vulnerability has been '
                'discovered in Notepad++ version 8.8.1, potentially exposing '
                'millions of users worldwide to complete system compromise. '
                'The flaw, designated CVE-2025-49144, allows attackers to gain '
                'SYSTEM-level privileges through a technique known as binary '
                'planting, with a proof-of-concept demonstration now publicly '
                'available.',
 'lessons_learned': 'The incident underscores the critical importance of '
                    'secure software development practices, particularly '
                    'regarding installer design and dependency loading '
                    'mechanisms in trusted applications.',
 'motivation': 'Complete system compromise',
 'recommendations': ['Implement additional protective measures, including '
                     'running installers from secure, isolated directories.',
                     'Maintain updated endpoint security solutions capable of '
                     'detecting binary planting attacks.',
                     'Consider implementing application whitelisting and '
                     'enhanced monitoring of installation processes.'],
 'response': {'remediation_measures': ['Notepad++ developers released version '
                                       '8.8.2 to address the vulnerability.']},
 'title': 'Privilege Escalation Vulnerability in Notepad++ v8.8.1',
 'type': 'Privilege Escalation',
 'vulnerability_exploited': 'CVE-2025-49144'}