Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2025-15556

CVE-2025-15556HIGH

notepad-plus-plus notepad-plus-plus — Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   N   N   P   H   H   H    7.7   .0177   77.4   YES

AFFECTED
  Product            Versions     Fixed
  notepad-plus-plus  unspecified  —

TIMELINE
  Feb 2   Reserved by VulnCheck
  Feb 3   Published (CNA: VulnCheck)
  Feb 12  Added to CISA KEV, remediation due 2026-03-05

CWE-494 · CNA: VulnCheck · CVSS v4.0 · 7 references · KEV due March 5, 2026

Description

Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically verified. An attacker able to intercept or redirect update traffic can cause the updater to download and execute an attacker-controlled installer, resulting in arbitrary code execution with the privileges of the user.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
February 2, 2026	Reserved	Reserved by VulnCheck
February 3, 2026	Published	Published (CNA: VulnCheck)
February 12, 2026	KEV ADDED	Added to CISA KEV, remediation due 2026-03-05

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
notepad-plus-plus	notepad-plus-plus	—	—	—

Weaknesses

CWE-494

References (7)

https://community.notepad-plus-plus.org/topic/27298/notepad-v8-8-9-vulnerability-fix [release-notes, patch]
https://github.com/notepad-plus-plus/notepad-plus-plus/commit/bcf2aa68ef414338d717e20e059459570ed6c5ab [patch]
https://github.com/notepad-plus-plus/wingup/commit/ce0037549995ed0396cc363544d14b3425614fdb [patch]
https://notepad-plus-plus.org//news//clarification-security-incident/ [third-party-advisory]
https://notepad-plus-plus.org/news/hijacked-incident-info-update/ [vendor-advisory]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-15556 [government-resource]
https://www.vulncheck.com/advisories/notepad-plus-plus-wingup-updater-lacks-update-integrity-verification [third-party-advisory]

Authoritative record: CVE-2025-15556 at cve.org

Vendors: notepad-plus-plus

Weaknesses: CWE-494

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2025-15556 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.