CVE-2025-15556: high-severity vulnerability in notepad-plus-plus
Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notepad++ versions before 8.8.9 don't verify that updates are legitimate before installing them. An attacker on the same network could intercept the update and replace it with malicious software that runs with your permissions.
The WinGUp updater in Notepad++ < 8.8.9 fails to cryptographically verify update metadata and installer packages, allowing a man-in-the-middle attacker to intercept update traffic and redirect it to a malicious binary. Exploitation requires network-level access to intercept the update connection, resulting in arbitrary code execution with user privileges.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.