📄 Description (English)
Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically verified. An attacker able to intercept or redirect update traffic can cause the updater to download and execute an attacker-controlled installer, resulting in arbitrary code execution with the privileges of the user.
🤖
Queued for AI Analysis
This CVE will be auto-analyzed on the next cron run.
🔗 References & Sources 7
🔗
https://community.notepad-plus-plus.org/topic/27298/notepad-v8-8-9-vulnerability-fix
disclosure@vulncheck.com
Release Notes
🔗
https://github.com/notepad-plus-plus/notepad-plus-plus/commit/bcf2aa68ef414338d717e20e0...
disclosure@vulncheck.com
Patch
🔗
https://github.com/notepad-plus-plus/wingup/commit/ce0037549995ed0396cc363544d14b342561...
disclosure@vulncheck.com
Patch
🔗
https://notepad-plus-plus.org/news/hijacked-incident-info-update/
disclosure@vulncheck.com
Patch
Vendor Advisory
🔗
https://www.vulncheck.com/advisories/notepad-plus-plus-wingup-updater-lacks-update-inte...
disclosure@vulncheck.com
Third Party Advisory
🔗
https://notepad-plus-plus.org//news//clarification-security-incident/
134c704f-9b21-4f2e-91b3-4a467353bcc0
Vendor Advisory
🔗
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-15556
134c704f-9b21-4f2e-91b3-4a467353bcc0
US Government Resource
📦 Affected Products / CPE 1 entries
notepad-plus-plus:notepad\+\+