CVE-2025-15556
HIGHCVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically verified. An attacker able to intercept or redirect update traffic can cause the updater to download and execute an attacker-controlled installer, resulting in arbitrary code execution with the privileges of the user.
AnalysisAI
Notepad++ versions prior to 8.8.9 contain an update integrity verification vulnerability (CVE-2025-15556) when using the WinGUp updater. The update mechanism fails to cryptographically verify downloaded metadata and installers, allowing man-in-the-middle attackers to serve malicious executables during the update process. KEV-listed, this supply chain risk affects one of the most widely used text editors on Windows.
Technical ContextAI
The WinGUp updater used by Notepad++ checks for updates and downloads installers over the network. Neither the update metadata (version check, download URL) nor the downloaded installer binary is cryptographically verified (no digital signature validation, no hash verification). An attacker in a network position to intercept or redirect HTTP/HTTPS traffic can serve a modified update manifest pointing to a malicious installer, or directly replace the installer binary during download.
RemediationAI
Update Notepad++ to 8.8.9 or later immediately. Download updates only from the official Notepad++ website. Verify installer signatures before execution. Consider deploying Notepad++ updates through centralized software management rather than auto-update.
Share
External POC / Exploit Code
Leaving vuln.today