CVE-2025-15556
Notepad++ Download of Code Without Integrity Check Vulnerability
Description
CVE-2025-15556 is a high-severity update integrity verification vulnerability in Notepad++ versions prior to 8.8.9 that affects the WinGUp auto-updater component. With a CVSS v3.1 base score of 7.5, this vulnerability arises because the update process does not cryptographically verify downloaded metadata or installer files, allowing an attacker who can intercept or redirect update traffic to deliver and execute arbitrary code on the victim's system. The attack requires network-level access to manipulate update traffic, which gives it high attack complexity (AC:H), but requires no privileges and only minimal user interaction in the form of accepting the update prompt. CISA has added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of March 5, 2026, and the ransomware association is classified as unknown. The EPSS score of 2.69% at the 85th percentile indicates elevated exploitation probability, consistent with the practical feasibility of supply-chain-style attacks targeting widely used software. Notepad++ is one of the most popular text editors on Windows with millions of active installations, making the potential impact of this supply chain vulnerability substantial.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| notepad-plus-plus | notepad\+\+ | < 8.8.9 |
References
- https://community.notepad-plus-plus.org/topic/27298/notepad-v8-8-9-vulnerability-fix(Release Notes)
- https://github.com/notepad-plus-plus/notepad-plus-plus/commit/bcf2aa68ef414338d717e20e059459570ed6c5ab(Patch)
- https://github.com/notepad-plus-plus/wingup/commit/ce0037549995ed0396cc363544d14b3425614fdb(Patch)
- https://notepad-plus-plus.org/news/hijacked-incident-info-update/(Patch, Vendor Advisory)
- https://www.vulncheck.com/advisories/notepad-plus-plus-wingup-updater-lacks-update-integrity-verification(Third Party Advisory)
- https://notepad-plus-plus.org//news//clarification-security-incident/(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-15556(US Government Resource)
Weakness Type
CWE-494: Download of Code Without Integrity Check
CVE-2025-15556 is classified under CWE-494 (Download of Code Without Integrity Check). This weakness occurs when software downloads executable code or critical update files from a remote source without verifying that the downloaded content has not been modified in transit. The WinGUp updater used by Notepad++ fetches update metadata and installer binaries over the network without performing cryptographic signature verification or hash validation. This means the updater has no mechanism to distinguish between a legitimate update from the Notepad++ project and a malicious replacement crafted by an attacker. CWE-494 is particularly dangerous in auto-update mechanisms because users inherently trust their software's built-in update process, and any compromise of that trust channel delivers malware with the same level of user confidence and system access as the legitimate application.
Impact Analysis
The impact of CVE-2025-15556 is severe across all three dimensions of the CIA triad, despite the higher attack complexity requirement. Confidentiality is fully compromised upon successful exploitation because the attacker's malicious installer executes with the same privileges as the Notepad++ updater, which typically runs with the current user's permissions and may be elevated to administrator if the user approves a UAC prompt. The malicious code can access all files, credentials, browser data, and sensitive information available to the user account, and can install persistent spyware or keyloggers.
Integrity faces high impact because the attacker replaces the legitimate Notepad++ installer with arbitrary code, which can install backdoors, modify system configurations, alter other installed software, or plant persistent malware that survives application reinstallation. The trust relationship between the user and their update mechanism is completely subverted, as the user believes they are installing a legitimate security update while actually executing malicious code.
Availability is at risk because the attacker's payload can perform any action available to the user, including encrypting files, deleting data, or disabling system services. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H reflects that the attack is network-based (AV:N) and requires the attacker to intercept or redirect network traffic (AC:H), such as through DNS hijacking, ARP spoofing, compromised network infrastructure, or a man-in-the-middle position. The user interaction requirement (UI:R) reflects that the victim must accept the update prompt, which most users will do reflexively when presented with a security update notification.
Exploit Maturity
CVE-2025-15556 has confirmed real-world exploitation, as evidenced by its addition to CISA's KEV catalog with a remediation deadline of March 5, 2026. The EPSS score of 2.69% at the 85th percentile indicates significantly elevated exploitation likelihood compared to the average vulnerability. Notepad++ has published a detailed account of the hijacking incident and the vulnerability fix (Notepad++ incident report), confirming that the update mechanism was actively targeted.
The attack surface is well-documented by VulnCheck's advisory (Notepad++ WinGUp Updater advisory), which details how the lack of integrity verification in the WinGUp updater creates a reliable supply chain attack vector. The high attack complexity (requiring network interception capability) limits mass exploitation compared to simpler vulnerabilities, but state-sponsored groups, sophisticated criminal organizations, and network-adjacent attackers on shared infrastructure have demonstrated the capability to execute these attacks. The Notepad++ community forum also provides the release notes for the patched version (v8.8.9 vulnerability fix).
Remediation
-
Update Notepad++ to version 8.8.9 or later immediately. Download the update directly from the official Notepad++ website rather than relying on the built-in updater, since the update mechanism itself is the vulnerable component. Verify the download using the checksums published on the official release page or the community forum post.
-
Disable the WinGUp auto-updater on systems that cannot be immediately updated. This prevents the vulnerable update mechanism from being triggered. In Notepad++, navigate to Settings > Preferences > MISC and disable automatic update checking. While this prevents exploitation through the update channel, it also means manual updates are required going forward until the patched version is installed.
-
Deploy the update across enterprise environments using centralized software management tools such as SCCM, Intune, PDQ Deploy, or Chocolatey. Do not rely on individual users to update manually. Create a deployment package using the official Notepad++ installer and push it to all managed endpoints.
-
Audit network security controls to assess the feasibility of man-in-the-middle attacks within your environment. Ensure that DNS infrastructure is secured against hijacking, implement DNSSEC where possible, and verify that network segmentation prevents attackers from establishing man-in-the-middle positions on segments where Notepad++ is installed.
-
Review systems for compromise indicators if Notepad++ was updated through the built-in updater during the vulnerable period. Check for unexpected executables, new scheduled tasks, unfamiliar services, or unusual network connections that may indicate a malicious update was installed. Verify the integrity of the installed Notepad++ binary by comparing its hash against the known-good value from the official release.
Technical Details
CVE-2025-15556 targets the WinGUp (Windows Generic Update Process) component used by Notepad++ for automatic software updates, described by the CVSS v3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability exists because the entire update pipeline, from metadata retrieval to installer download and execution, lacks cryptographic integrity verification.
The WinGUp updater operates by periodically checking a remote server for available updates. It downloads an XML or configuration file describing the latest version, compares it against the currently installed version, and if an update is available, downloads the installer binary and prompts the user to install it. At no point in this process does the updater verify that the downloaded metadata or binary has been signed by the Notepad++ project or that its content matches an expected cryptographic hash. This means an attacker who can tamper with the network communication between the updater and the update server can substitute both the version metadata and the installer binary with attacker-controlled content.
The attack requires the ability to intercept or redirect network traffic between the target system and the Notepad++ update server, which accounts for the high attack complexity (AC:H) rating. Practical attack scenarios include DNS spoofing or hijacking to redirect the update server hostname to an attacker-controlled server, ARP spoofing on local networks to intercept traffic, compromised network infrastructure such as routers or proxies, and man-in-the-middle attacks on networks without proper TLS enforcement. Once the attacker delivers a malicious installer through the update channel, the user is presented with a standard update prompt and, upon acceptance, the malicious code executes with the user's privileges.
Notepad++ versions prior to 8.8.9 are affected. The fix in version 8.8.9 introduces cryptographic verification of update metadata and installer binaries, ensuring that only content signed by the Notepad++ project is accepted by the updater. This closes the integrity gap and prevents man-in-the-middle attackers from injecting malicious content into the update pipeline.
Frequently Asked Questions
What is CVE-2025-15556?
CVE-2025-15556 is a high-severity vulnerability in Notepad++ versions prior to 8.8.9 where the WinGUp auto-updater does not cryptographically verify downloaded updates. An attacker who can intercept update traffic can deliver and execute malicious code on the victim's system.
How does CVE-2025-15556 work?
The Notepad++ updater downloads update metadata and installer files without verifying their authenticity. An attacker who can intercept network traffic through DNS hijacking, ARP spoofing, or other man-in-the-middle techniques can replace the legitimate update with a malicious installer that executes when the user accepts the update prompt.
Is CVE-2025-15556 a supply chain attack?
Yes. CVE-2025-15556 enables a supply chain attack by compromising the trusted software update channel. Users who believe they are installing a legitimate Notepad++ update are instead executing attacker-controlled code.
Who is at risk from CVE-2025-15556?
Any user or organization running Notepad++ versions prior to 8.8.9 with the auto-updater enabled is at risk, particularly on networks where an attacker could achieve a man-in-the-middle position, such as shared or public networks, compromised corporate networks, or environments with weak DNS security.
How do I fix CVE-2025-15556?
Update Notepad++ to version 8.8.9 or later by downloading the installer directly from the official Notepad++ website. Do not use the built-in updater for this specific update, as the updater itself is the vulnerable component. After updating, the auto-updater will include cryptographic verification for future updates.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.