PT-2026-5735 · Notepad++ · Notepad++

Published 2025-12-09 · Updated 2026-03-10 · CVE-2025-15556

Positive Technologies · (AI Summary)

CVSS v4.0

7.7

High

AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Notepad++ versions prior to 8.8.9

Description The Notepad++ WinGUp updater has a flaw in how it verifies the integrity of updates. This allows an attacker who can intercept or redirect update traffic to cause the updater to download and execute a malicious installer, leading to arbitrary code execution with the privileges of the user. This issue has been actively exploited in attacks, as highlighted by CISA. The vulnerability stems from a lack of cryptographic verification of downloaded update metadata and installers. Attackers could potentially use man-in-the-middle (MitM) techniques or DNS spoofing to redirect users to rogue update servers and deliver trojanized installers.

Recommendations Versions prior to 8.8.9 should be updated to version 8.8.9 or later.

Fix

Weakness Enumeration

CWE-353

CWE-494

Related Identifiers

BDU:2025-15900

CVE-2025-15556

Affected Products

Notepad++

References · 46

• https://github.com/notepad-plus-plus/notepad-plus-plus/commit/bcf2aa68ef414338d717e20e059459570ed6c5ab · Patch
• https://github.com/notepad-plus-plus/wingup/commit/ce0037549995ed0396cc363544d14b3425614fdb · Patch
• https://notepad-plus-plus.org/news/clarification-security-incident · Security Note
• https://osv.dev/vulnerability/CVE-2025-15556 · Vendor Advisory
• https://notepad-plus-plus.org/news/hijacked-incident-info-update · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15556 · Security Note
• https://bdu.fstec.ru/vul/2025-15900 · Security Note
• https://notepad-plus-plus.org//news//clarification-security-incident · Vendor Advisory
• https://reddit.com/r/CVEWatch/comments/1r3mbfe/top_10_trending_cves_13022026 · Reddit Post
• https://t.me/CSIRT_italia/3127 · Telegram Post
• https://twitter.com/CISACyber/status/2022050902236946894 · Twitter Post
• https://twitter.com/dailytechonx/status/2022345530349584683 · Twitter Post
• https://t.me/cveNotify/151913 · Telegram Post
• https://twitter.com/Mary38355964/status/2020134835373670482 · Twitter Post
• https://twitter.com/ThreatSynop/status/2022238518727016762 · Twitter Post