Notepad
CVE-2025-15556
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Code integrity verification
|
| Impact | CVSS 7.5 (High). KEV-listed — actively exploited. EPSS 4.3%. Patch available (v8.8.9+). Requires network interception (MITM) position. Notepad++ has massive install base among developers and sysadmins. Supply chain attack vector — targets software update trust. |
| Exploit ScenarioDerived | An attacker on the same network as the target (corporate network, public WiFi, compromised router) intercepts Notepad++'s update check request and responds with a modified manifest indicating a newer version is available. When the user accepts the update, the attacker serves a trojanized Notepad++ installer that includes a backdoor or info-stealer. The user runs the installer believing it's a legitimate update, granting the malware execution with the user's privileges. In targeted scenarios, this can be combined with DNS hijacking or BGP manipulation for remote exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Notepad++ versions prior to 8.8.9 contain an update integrity verification vulnerability (CVE-2025-15556) when using the WinGUp updater. The update mechanism fails to cryptographically verify downloaded metadata and installers, allowing man-in-the-middle attackers to serve malicious executables during the update process. KEV-listed, this supply chain risk affects one of the most widely used text editors on Windows.
Earlier versions of this analysis (1)
Notepad++'s WinGUp update mechanism (CWE-494) downloads update metadata and installer binaries without cryptographic verification, enabling attackers who can intercept network traffic to replace legitimate updates with malicious executables.
RemediationAI
Update Notepad++ to 8.8.9 or later immediately. Download updates only from the official Notepad++ website. Verify installer signatures before execution. Consider deploying Notepad++ updates through centralized software management rather than auto-update.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The WinGUp updater used by Notepad++ checks for updates and downloads installers over the network. Neither the update metadata (version check, download URL) nor the downloaded installer binary is cryptographically verified (no digital signature validation, no hash verification). An attacker in a network position to intercept or redirect HTTP/HTTPS traffic can serve a modified update manifest pointing to a malicious installer, or directly replace the installer binary during download.
Know when Notepad gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically verified. An attacker able to intercept or redirect update traffic can cause the updater to download and execute an attacker-controlled installer, resulting in arbitrary code execution with the privileges of the user.
Executive ViewAI
Notepad++ versions before 8.8.9 are vulnerable to update hijacking attacks where malicious code can be injected without detection, potentially compromising systems organization-wide. This vulnerability is actively exploited in the wild and affects any user relying on the built-in WinGUp updater for automatic patches.
Apply vendor patch. If immediate patching is unavailable: disable WinGUp auto-update feature on all systems, block WinGUp update servers at the firewall/proxy level, require manual updates only from verified official sources with hash verification, and monitor for suspicious Notepad++ process behavior and network connections to update infrastructure.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
Buffer overflow in NotePad++ 6.6.9 allows remote attackers to have unspecified impact via a long Time attribute in an Ev
memono Notepad 4.2 contains a denial of service vulnerability that allows attackers to crash the application by pasting
An Untrusted search path vulnerability in notepad++ 6.5 allows local users to gain escalated privileges through the msim
Notepad++ is a free and open-source source code editor. Rated high severity (CVSS 7.8), this vulnerability is no authent
Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerable dll (Ux
SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode ch
Notepad++ versions before 8.9.2 allow local code execution through an unsafe search path vulnerability that permits atta
String injection in Notepad++ 8.9.3 leads to memory address disclosure or application crash when processing maliciously
Notepad++ v8.4.1 was discovered to contain a stack overflow via the component Finder::add(). Rated medium severity (CVSS
Notepad++ is a free and open-source source code editor. Rated medium severity (CVSS 5.5), this vulnerability is no authe
Notepad++ is a free and open-source source code editor. Rated medium severity (CVSS 5.5), this vulnerability is no authe
Notepad++ is a free and open-source source code editor. Rated medium severity (CVSS 5.5), this vulnerability is no authe
Exploit-DB