High severity · published Feb 3, 2026
CVE-2025-15556
Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification
In wildKEV
7.5
CVSS
1.8%
EPSS
Yes
On KEV
Description
Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically verified. An attacker able to intercept or redirect update traffic can cause the updater to download and execute an attacker-controlled installer, resulting in arbitrary code execution with the privileges of the user.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildYes
CISA KEVListed Feb 12, 2026
Federal remediation dueMar 5, 2026
Ransomware campaign useNot known
Affected products
Which versions
NO
notepad-plus-plus · notepad-plus-plus
before 8.8.9 · source: vendor
NO
Notepad++ · Notepad-plus-plus
before 8.8.9 · source: NVD, KEV
In the news
VulnerabilityHigh
[CISA KEV] CVE-2025-15556: Notepad++ Notepad++ - Notepad++ Download of Code Without Integrity Check Vulnerability
Notepad++ when using the WinGUp updater, contains a download of code without integrity check vulnerability that could allow an attacker to intercept or redirect update traffic to download and execute an attacker-controlled installer. This could lead to arbitrary code execution with the privileges of the user.
NONotepad++CVE-2025-15556
Feb 12, 2026·CISA KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-15556
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-15556
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
release-notes
https://community.notepad-plus-plus.org/topic/27298/notepad-v8-8-9-vulnerability-fix
vendor-advisory
https://notepad-plus-plus.org/news/hijacked-incident-info-update/
patch
https://github.com/notepad-plus-plus/notepad-plus-plus/commit/bcf2aa68ef414338d717e20e059459570ed6c5ab
patch
https://github.com/notepad-plus-plus/wingup/commit/ce0037549995ed0396cc363544d14b3425614fdb
third-party-advisory
https://www.vulncheck.com/advisories/notepad-plus-plus-wingup-updater-lacks-update-integrity-verification
More from notepad-plus-plus
8.6
CVE-2026-85279
Notepad++: Stack Buffer Overflow in Plugin Lexer Loading via Unchecked GetLexerCount() Return Value
8.1
CVE-2026-57233
Notepad++: Path Traversal (Zip Slip) in WinGup Plugin Extraction
7.8
CVE-2026-77605
Notepad++ “Run by system” executes *.txt.cmd when user selected *.txt (target confusion → command execution)
7.8
CVE-2026-86054
Notepad++: Stack Buffer Overflow in `NppParameters::writeSession` via overlong session path
7.8
CVE-2026-54758
Notepad++: Stack Buffer Overflow in expandNppEnvironmentStrs