« Volver al listado

CVE-2025-49144

Estado: AplazadaAlta (7.3)—

Notepad++ is a free and open-source source code editor. In versions 8.8.1 and prior, a privilege escalation vulnerability exists in the Notepad++ v8.8.1 installer that allows unprivileged users to gain SYSTEM-level privileges through insecure executable search paths. An attacker could use social engineering or clickjacking to trick users into downloading both the legitimate installer and a malicious executable to the same directory (typically Downloads folder - which is known as Vulnerable directory). Upon running the installer, the attack executes automatically with SYSTEM privileges. This issue has been fixed and will be released in version 8.8.2.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

UI:R (interacción requerida para ejecutar el instalador) → T1203. El ataque logra privilegios SYSTEM mediante DLL hijacking en ruta de búsqueda insegura (CWE-427), clasificado como T1068 (escalada). T1574.007 por la manipulación de carga de ejecutables.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution PreventionApplication Isolation and SandboxingExploit ProtectionUpdate SoftwareThreat Intelligence ProgramRestrict File and Directory Permissions

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Notepad++ — Notepad++AI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-49144",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-49144",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-01T03:55:56.996774Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.3,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.3
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "notepad-plus-plus",
          "product": "notepad-plus-plus",
          "versions": [
            {
              "status": "affected",
              "version": "< 8.8.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-06-23T19:15:23.727",
  "references": [
    {
      "url": "https://drive.google.com/drive/folders/11yeUSWgqHvt4Bz5jO3ilRRfcpQZ6Gvpn",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/notepad-plus-plus/notepad-plus-plus/commit/f2346ea00d5b4d907ed39d8726b38d77c8198f30",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-9vx8-v79m-6m24",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://www.vicarius.io/vsociety/posts/cve-2025-49144-detect-notepad-vulnerability",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.vicarius.io/vsociety/posts/cve-2025-49144-detect-notepad-vulnerability-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.vicarius.io/vsociety/posts/cve-2025-49144-mitigate-notepad-vulnerability",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.vicarius.io/vsociety/posts/cve-2025-49144-mitigate-notepad-vulnerability-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-272"
        },
        {
          "lang": "en",
          "value": "CWE-276"
        },
        {
          "lang": "en",
          "value": "CWE-427"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Notepad++ is a free and open-source source code editor. In versions 8.8.1 and prior, a privilege escalation vulnerability exists in the Notepad++ v8.8.1 installer that allows unprivileged users to gain SYSTEM-level privileges through insecure executable search paths. An attacker could use social engineering or clickjacking to trick users into downloading both the legitimate installer and a malicious executable to the same directory (typically Downloads folder - which is known as Vulnerable directory). Upon running the installer, the attack executes automatically with SYSTEM privileges. This issue has been fixed and will be released in version 8.8.2."
    },
    {
      "lang": "es",
      "value": "Notepad++ es un editor de código fuente gratuito y de código abierto. En las versiones 8.8.1 y anteriores, existe una vulnerabilidad de escalada de privilegios en el instalador de Notepad++ v8.8.1 que permite a usuarios sin privilegios obtener privilegios de sistema mediante rutas de búsqueda de ejecutables inseguras. Un atacante podría usar ingeniería social o clickjacking para engañar a los usuarios y que descarguen tanto el instalador legítimo como un ejecutable malicioso en el mismo directorio (normalmente la carpeta Descargas, conocida como directorio vulnerable). Al ejecutar el instalador, el ataque se ejecuta automáticamente con privilegios de sistema. Este problema se ha solucionado y se publicará en la versión 8.8.2."
    }
  ],
  "lastModified": "2026-06-17T09:30:49.357",
  "sourceIdentifier": "security-advisories@github.com"
}