CVE-2025-15556 Notepad++ Download of Code Without Integrity Check

What is CVE-2025-15556?

CVE-2025-15556 is a high-severity vulnerability in notepad-plus-plus, published on 3 Feb 2026.

Official description

Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically verified. An attacker able to intercept or redirect update traffic can cause the updater to download and execute an attacker-controlled installer, resulting in arbitrary code execution with the privileges of the user.

Weakness: CWE-494

Which versions are affected by CVE-2025-15556?

It affects 1 product.

Products include Notepad-Plus-Plus Notepad\+\+.

How do I fix CVE-2025-15556?

No fix has been published for CVE-2025-15556 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 5 Mar 2026.

Is CVE-2025-15556 being exploited?

Yes. Attackers have exploited CVE-2025-15556 in the wild since at least 12 Feb 2026.

Public exploit code: 2 proofs of concept on GitHub.

Other vulnerabilities in notepad-plus-plus

• CVE-2026-48778 Notepad++: Arbitrary Code Execution via config.xml commandLineInterpreter High 7.8
• CVE-2026-48800 Notepad++: Arbitrary Code Execution via shortcuts.xml UserCommand Injection High 7.8
• CVE-2026-52884 Notepad++: CVE-2026-48800 Bypass High 7.8
• CVE-2023-47452 Privilege escalation in n/a High 7.8
• CVE-2023-40031 Notepad++ vulnerable to heap buffer write overflow in Utf8_16_Read::convert High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cqx4-h5ph-3xj9.