high7.5Known exploited
CVE-2025-15556
Notepad++ Download of Code Without Integrity Check Vulnerability
Exploited in the wild
This vulnerability is on the CISA Known Exploited Vulnerabilities list, added 2026-02-12. Federal due date: 2026-03-05.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Impact
Notepad++ when using the WinGUp updater, contains a download of code without integrity check vulnerability that could allow an attacker to intercept or redirect update traffic to download and execute an attacker-controlled installer. This could lead to arbitrary code execution with the privileges of the user.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Notepad-Plus-Plus | Notepad\+\+ | before 8.8.9 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- https://community.notepad-plus-plus.org/topic/27298/notepad-v8-8-9-vulnerability-fix
- https://github.com/notepad-plus-plus/notepad-plus-plus/commit/bcf2aa68ef414338d717e20e059459570ed6c5ab
- https://github.com/notepad-plus-plus/wingup/commit/ce0037549995ed0396cc363544d14b3425614fdb
- https://notepad-plus-plus.org/news/hijacked-incident-info-update/
- https://www.vulncheck.com/advisories/notepad-plus-plus-wingup-updater-lacks-update-integrity-verification
- https://notepad-plus-plus.org//news//clarification-security-incident/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-15556