CVE-2025-15556 - CVE House
Back to Database
Status published High CVE-2025-15556

Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification

Vulnerability Description

Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically verified. An attacker able to intercept or redirect update traffic can cause the updater to download and execute an attacker-controlled installer, resulting in arbitrary code execution with the privileges of the user.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-15556

Credits & Attribution

No credits recorded in the NVD database.

References

More from notepad-plus-plus

View All →
CVE-2025-49144
Notepad++ Privilege Escalation in Installer via Uncontrolled Executable Search Path
High 7.3
CVE-2023-40166
Notepad++ heap buffer read overflow in FileManager::detectLanguageFromTextBegining
Medium 5.5
CVE-2023-40164
Notepad++ global buffer read overflow in nsCodingStateMachine::NextState
Medium 5.5
CVE-2023-40036
Notepad++ global buffer read overflow in CharDistributionAnalysis::HandleOneChar
Medium 5.5
CVE-2023-40031
Notepad++ vulnerable to heap buffer write overflow in Utf8_16_Read::convert
High 7.8

Affected Vendor

notepad-plus-plus

View all reports →

Affected Software

notepad-plus-plus
Vulnerable Versions:
0

Timeline

Official Publish: February 3rd, 2026
Last Modified: March 5th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-494

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.