Loading story…
Notepad++ developers released fixes for a high-severity vulnerability in the application's installer, tracked as CVE-2025-49144, that can let an authenticated local attacker escalate privileges and execute code as SYSTEM. The issue affects Notepad++ installer versions 8.8.1 and earlier and does not impact the text editor itself; the flaw carries a CVSS 7.3 severity rating, and a public proof-of-concept exploit is available.
The bug can also be exploited in a remote attack chain if a user is tricked into downloading both a vulnerable installer and a malicious executable into the same folder before launching the installer. Defenders are advised to upgrade to Notepad++ 8.8.2 to remediate the issue and review software distribution workflows that may expose users to tampered installer directories.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
A CVE record exists for CVE-2025-49144, documenting the Notepad++ installer vulnerability. The flaw enables local authenticated privilege escalation and can lead to SYSTEM-level code execution under certain conditions.
Public proof-of-concept exploit code was made available for CVE-2025-49144. The disclosure increased the practical risk of exploitation of the vulnerable Notepad++ installer.
Notepad++ developers released security updates to fix CVE-2025-49144, a high-severity privilege escalation flaw in the application's installer affecting version 8.8.1 and earlier. Users and administrators were advised to update to Notepad++ 8.8.2.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Notepad++ released version **8.9.7** with fixes for five security vulnerabilities, including a critical installer-based flaw that could allow **PowerShell command injection** and arbitrary code execution. Reported issues also include a stack buffer overflow, a **Zip Slip** path traversal vulnerability in the `WinGUp` updater, a `session.xml` path validation bypass, and a `shortcuts.xml` macro HMAC integrity bypass. The weaknesses could be exploited through tampered installers, malicious local configuration files, or abuse of update extraction to overwrite files, corrupt memory, bypass protections, or fully compromise a system. The Canadian Centre for Cyber Security issued advisory **AV26-703**, warning that vulnerabilities affect **Notepad++ versions prior to 9.7** and urging users and administrators to review the vendor guidance and apply updates. The notice points to the Notepad++ security advisory and release resources for remediation, while reporting indicates users should update manually rather than wait for the staged auto-updater rollout.
Jul 17, 2026
Notepad++ disclosed a **critical** vulnerability affecting version **8.9.3 and earlier**, and the Canadian Centre for Cyber Security urged users to apply the vendor’s update. The issue is tracked as **`CVE-2026-3008`** and has been described as a **string injection** flaw that can let an attacker obtain memory address information or crash the application; the recommended remediation is to upgrade to **Notepad++ 8.9.4**. Public CVE records indicate the flaw is remotely reachable with **low attack complexity**, requires **no privileges** and **no user interaction**, and carries high potential impact across confidentiality, integrity, and availability. References tied to the disclosure include Notepad++ release materials, issue-tracking resources, and a Singapore CSA advisory, underscoring broad public disclosure and the need for rapid patching on systems where Notepad++ is installed.
Jun 29, 2026
Notepad++ released **v8.9.6.1** to fix three vulnerabilities affecting versions up to **8.9.6**, including two arbitrary code execution flaws tracked as `CVE-2026-48778` and `CVE-2026-48800`, and a denial-of-service crash bug tracked as `CVE-2026-48770`. The most serious issue involves unsafe handling of the `commandLineInterpreter` value in `config.xml`, which can be passed to `ShellExecute()` when a user invokes the **Open Containing Folder in cmd** feature, allowing attacker-controlled programs to run instead of the intended interpreter. A separate flaw in `shortcuts.xml` also enables arbitrary code execution, while malformed XML structures can trigger application crashes. Advisories and follow-on reporting said exploitation could occur if an attacker can tamper with `%APPDATA%\Notepad++\config.xml`, abuse the `-settingsDir` parameter through malicious `.lnk` files, poison cloud-synced settings, or socially engineer users into opening archives that place malicious configuration files in writable paths. A published proof of concept demonstrated the `config.xml` issue by launching `calc.exe`. The Canadian Centre for Cyber Security urged users and administrators to apply the update, while researchers recommended restricting write access to configuration directories, validating executable paths, and monitoring shared or synced settings locations in enterprise environments.
Jun 29, 2026