Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification

Notepad++ versions before 8.8.9 don't verify that updates are legitimate before installing them. An attacker on the same network could intercept the update and replace it with malicious software that runs with your permissions.

The WinGUp updater in Notepad++ < 8.8.9 fails to cryptographically verify update metadata and installer packages, allowing a man-in-the-middle attacker to intercept update traffic and redirect it to a malicious binary. Exploitation requires network-level access to intercept the update connection, resulting in arbitrary code execution with user privileges.