📄 الوصف (الإنجليزية)
Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically verified. An attacker able to intercept or redirect update traffic can cause the updater to download and execute an attacker-controlled installer, resulting in arbitrary code execution with the privileges of the user.
🤖
في طابور التحليل الذكي
سيتم تحليل هذا CVE تلقائياً في المهام المجدولة.
🔗 المراجع والمصادر 7
🔗
https://community.notepad-plus-plus.org/topic/27298/notepad-v8-8-9-vulnerability-fix
disclosure@vulncheck.com
Release Notes
🔗
https://github.com/notepad-plus-plus/notepad-plus-plus/commit/bcf2aa68ef414338d717e20e0...
disclosure@vulncheck.com
Patch
🔗
https://github.com/notepad-plus-plus/wingup/commit/ce0037549995ed0396cc363544d14b342561...
disclosure@vulncheck.com
Patch
🔗
https://notepad-plus-plus.org/news/hijacked-incident-info-update/
disclosure@vulncheck.com
Patch
Vendor Advisory
🔗
https://www.vulncheck.com/advisories/notepad-plus-plus-wingup-updater-lacks-update-inte...
disclosure@vulncheck.com
Third Party Advisory
🔗
https://notepad-plus-plus.org//news//clarification-security-incident/
134c704f-9b21-4f2e-91b3-4a467353bcc0
Vendor Advisory
🔗
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-15556
134c704f-9b21-4f2e-91b3-4a467353bcc0
US Government Resource
📦 المنتجات المتأثرة 1 منتج
notepad-plus-plus:notepad\+\+