Notepad++ Vulnerability Allows Attacker to Take Full Control of System – PoC Released

A critical privilege escalation vulnerability has been discovered in Notepad++ v8.8.1 installer that enables unprivileged users to gain SYSTEM-level privileges through exploiting insecure executable search paths.

The vulnerability, tracked as GHSA-9vx8-v79m-6m24 and published by donho three days ago, affects the popular text editor’s installer released on May 5, 2025, and has been successfully demonstrated through proof-of-concept materials including video evidence of exploitation.

The vulnerability stems from an uncontrolled executable search path weakness, specifically classified as an Uncontrolled EXE/DLL Search Path (Binary Planting) issue.

The Notepad++ v8.8.1 installer fails to properly verify executable dependencies, instead searching for required files in the current working directory without adequate security controls.

This fundamental vulnerability creates an opportunity for attackers to place malicious executables in predictable locations where the installer will discover and execute them with elevated SYSTEM privileges.

Process Monitor logs have confirmed that the installer actively searches for executables in the current directory during installation procedures.

The vulnerability follows patterns similar to previously disclosed issues, including CVE-2023-6401 and CVE-2023-47452 in earlier Notepad++ versions, as well as CVE-2024-44346 and the Dell SupportAssist vulnerability (DSA-2024-312).

Microsoft guidance on secure library loading specifically addresses these types of vulnerabilities, emphasizing the importance of controlled search paths for executable dependencies.

Notepad++ Vulnerability

The attack methodology requires minimal sophistication and user interaction, making it particularly dangerous in real-world scenarios.

Attackers begin by placing malicious executables, such as a compromised regsvr32.exe file, in target directories where users commonly download software.

The Downloads folder represents a particularly vulnerable location due to its frequent use for installer files.

Social engineering and clickjacking techniques can effectively trick users into downloading both the legitimate Notepad++ installer and malicious executables to the same directory location.

Once the user executes the installer, the vulnerability triggers automatically, loading the attacker’s malicious code with SYSTEM-level privileges without requiring additional user intervention.

Proof-of-concept materials, including demonstration videos and technical documentation, have been made available through a Google Drive folder, confirming successful privilege escalation via reverse shell techniques.

Security Implications

The security implications of this vulnerability extend far beyond simple privilege escalation. Successful exploitation grants attackers complete system control, enabling arbitrary code execution with the highest available privileges on Windows systems.

Security researchers recommend immediate updating to version 8.8.2 for all affected installations.

This level of access facilitates potential data theft, system manipulation, and lateral movement across network infrastructure, particularly in enterprise environments where Notepad++ enjoys widespread deployment.

Notepad++ developers have addressed the vulnerability in version 8.8.2, which serves as the patched release for affected installations.

The remediation effort involves implementing several critical security improvements, including modification of the installer to utilize absolute paths for dependency loading, implementation of digital signature verification for loaded executables, and creation of secure temporary directories with randomized names.

Organizations should also consider implementing additional defense-in-depth measures, including application whitelisting and enhanced monitoring of installer processes.

While Microsoft traditionally classifies some binary planting issues as “Defense-in-Depth” concerns, the severity of achieving SYSTEM privileges through minimal user interaction elevates this vulnerability to high-priority status requiring immediate attention from system administrators and security teams.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.