High-Severity Vulnerability in Notepad++

Post by maskull » Tue, Jul 01, 2025, 11:06 AM UTC

notepad0x90 wrote: post #6

I wanted to say the installer has no business running things as SYSTEM but I suppose there is no way around that for registering COM DLLs. I would think Attackers would need to chain this with a Uac bypass (or be fortunate enough to find Uac disabled). If Uac is setup right, administrative operations like regsvr32 should require going through consent.exe's prompt. Uac bypasses are plenty but systems can be configured…

Post by delfinom » Tue, Jul 01, 2025, 12:08 PM UTC

notepad0x90 wrote: post #7

reanimus wrote: post #2

Headline is a little misleading imo -- the vulnerability isn't in Notepad++ itself as much as its installer. Current users, I imagine, don't have anything to worry about.

Unless the updater also runs the installer, then you just drop your malicious dll in the right place and wait for an update, or find a way to force-trigger an update. Attackers can also use the notepad installer as a payload execution mechanism. To run your malware, just get older notepad++ installers and drop your dll after the installer is running to run it as SYSTEM.

Post by notepad0x90 » Wed, Jul 02, 2025, 2:43 AM UTC

delfinom wrote: post #13

notepad0x90 wrote: post #7

Earlier quoted context omitted.

Unless the updater also runs the installer, then you just drop your malicious dll in the right place and wait for an update, or find a way to force-trigger an update. Attackers can also use the notepad installer as a payload execution mechanism. To run your malware, just get older notepad++ installers and drop your dll after the installer is running to run it as SYSTEM.

Meh, there's plenty of Microsoft services on a system that fall for the same trick. If an attacker has PC access, its game over anyway.