Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification
Priority CRITICAL 93Exploited in the wildCWE-494Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-494.
Summary
Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically verified. An attacker able to intercept or redirect update traffic can cause the updater to download and execute an attacker-controlled installer, resulting in arbitrary code execution with the privileges of the user.
Why it matters now
Exploitation Active In CISA KEV since 2026-02-12CISA due date 2026-03-05
EPSS 0.01746 77th percentileScored 2026-11-07
Fix Fixed notepad-plus-plus (notepad-plus-plus): 8.8.9
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| notepad-plus-plus | notepad-plus-plus | before 8.8.9 | 8.8.9 | Patch available | CNA |
- notepad-plus-plus Vendornotepad-plus-plus Affected before 8.8.9 Fixed in 8.8.9 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:notepad-plus-plus:notepad\+\+:*:*:*:*:*:*:*:* | before 8.8.9 | Vulnerable | notepad-plus-plus |
- cpe:2.3:a:notepad-plus-plus:notepad\+\+:*:*:*:*:*:*:*:* Versions before 8.8.9 Vulnerable ·notepad-plus-plus
Remediation
- Fix · CNA notepad-plus-plus (notepad-plus-plus) Fixed in 8.8.9
Timeline
- 2026-02-12 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2025-15556
- 2026-10-03 Alias added: GHSA-cqx4-h5ph-3xj9
References
Patch 4
- https://community.notepad-plus-plus.org/topic/27298/notepad-v8-8-9-vulnerability-fix
- https://notepad-plus-plus.org/news/hijacked-incident-info-update/
- https://github.com/notepad-plus-plus/notepad-plus-plus/commit/bcf2aa68ef414338d717e20e059459570ed6c5ab
- https://github.com/notepad-plus-plus/wingup/commit/ce0037549995ed0396cc363544d14b3425614fdb
More notepad-plus-plus Notepad++ vulnerabilities
- TI-2026-36070 Notepad++: Arbitrary Code Execution via shortcuts.xml UserCommand Injection CVSS 3.1HIGH 7.8
- TI-2026-36048 Notepad++: Arbitrary Code Execution via config.xml commandLineInterpreter CVSS 3.1HIGH 7.8
- TI-2026-04836 Stack-Based Buffer Overflow in Notepad++ File Drop Handler leads to DoS CVSS 3.1HIGH 7.8
- TI-2023-20921 Notepad++ vulnerable to heap buffer write overflow in Utf8_16_Read::convert CVSS 3.1HIGH 7.8
- TI-2026-37981 Notepad++ TOCTOU: HMAC Checks Disk, Executes from Memory CVSS 4.0HIGH 7.5
- TI-2022-13732 Buffer overflow in function Notepad_plus::addHotSpot in Notepad++ v8.4.3 and earlier… CVSS 3.1MEDIUM 6.5
Sources
- CVE-2025-15556 · CVE Program
- CVE-2025-15556 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-cqx4-h5ph-3xj9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences