CVE2025

CVE-2025-49144

1Rules

2References

1Folders

2025-06-26Latest

Summary

CVE-2025-49144 is tracked here through 1 Sigma detection for exploitation attempts and related post-exploitation behavior observed in 2025. Coverage centers on windows / process_creation.

Related Detections

Search this threat

Emerging Threathighexperimental

Potential Notepad++ CVE-2025-49144 Exploitation

Detects potential exploitation of CVE-2025-49144, a local privilege escalation vulnerability in Notepad++ installers (v8.8.1 and prior) where the installer calls regsvr32.exe without specifying the full path. This allows an attacker to execute arbitrary code with elevated privileges by placing a malicious regsvr32.exe alongside this Legitimate Notepad++ installer. The vulnerability is triggered when the installer attempts to register the NppShell.dll file, which is a component of Notepad++.

WindowsProcess Creation

TA0003 · PersistenceTA0004 · Privilege EscalationTA0005 · StealthT1574.008 · Path Interception by Search Order Hijacking+2

Swachchhanda Shrawan Poudel (Nextron Systems)Thu Jun 262025

References