CVE-2025-15556
Notepad++ Download of Code Without Integrity Check Vulnerability
Notepad++ Notepad++
CVSS
7.7HighExploit odds (EPSS)1.77%Chance of exploitation activity in the next 30 days, higher than 78% of CVEs. Scored 23 Oct 2026FIRST EPSS
CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV
What fixes it
- 8.8.9notepad-plus-plusCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Timeline
Description
Notepad++ when using the WinGUp updater, contains a download of code without integrity check vulnerability that could allow an attacker to intercept or redirect update traffic to download and execute an attacker-controlled installer. This could lead to arbitrary code execution with the privileges of the user.
Text from CVE List
Affected versions 1
- notepad-plus-plusaffected: all versions before 8.8.9CVE List
References 9
- community.notepad-plus-plus.org/topic/27298/notepad-v8-8-9-vulnerability-fixFixvia CVE List
- github.com/notepad-plus-plus/notepad-plus-plus/commit/bcf2aa68ef414338d717e20e059459570ed6c5abFixvia CVE List
- github.com/notepad-plus-plus/wingup/commit/ce0037549995ed0396cc363544d14b3425614fdbFixvia CVE List
- notepad-plus-plus.org/news/clarification-security-incident/Advisoryvia CISA KEV
- notepad-plus-plus.org/news/hijacked-incident-info-update/Advisoryvia CVE List
- vulncheck.com/advisories/notepad-plus-plus-wingup-updater-lacks-update-integrity-verificationAdvisoryvia CVE List
- notepad-plus-plus.org//news//clarification-security-incident/Advisoryvia CVE List
- nvd.nist.gov/vuln/detail/CVE-2025-15556Referencevia CISA KEV
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-15556Referencevia CVE List