CVE-2025-15556
CVE-2025-15556 is a high-severity vulnerability in Notepad-plus-plus Notepad++ with a CVSS 3.x base score of 7.5. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming it has been exploited in the wild (added 2026-02-12). The underlying weakness is classified as CWE-494.
Key facts
- Severity: High (CVSS 3.x base score 7.5)
- CVSS v4: 7.7
- EPSS exploit prediction: 1% (66th percentile)
- Actively exploited: Yes — listed in CISA KEV (added 2026-02-12)
- EU (EUVD) id: EUVD-2025-206661
- EU exploitation: Flagged exploited in the ENISA EU Vulnerability Database (since 2026-02-12)
- Weakness: CWE-494
- Affected product: Notepad-plus-plus Notepad++
- Published:
- Last modified:
Description
Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically verified. An attacker able to intercept or redirect update traffic can cause the updater to download and execute an attacker-controlled installer, resulting in arbitrary code execution with the privileges of the user.
Frequently asked questions
- What is CVE-2025-15556?
- Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically verified. An attacker able to intercept or redirect update traffic can cause the updater to download and execute an attacker-controlled installer, resulting in arbitrary code execution with the privileges of the user.
- How severe is CVE-2025-15556?
- CVE-2025-15556 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2025-15556 being actively exploited?
- Yes. CVE-2025-15556 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2026-02-12, which means active exploitation has been confirmed. It should be prioritised for remediation.
- What products are affected by CVE-2025-15556?
- CVE-2025-15556 affects Notepad-plus-plus Notepad++. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2025-15556?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.
- Does CVE-2025-15556 have an EU (EUVD) identifier?
- Yes. CVE-2025-15556 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-206661. It is also flagged as exploited in the EUVD (since 2026-02-12).
- When was CVE-2025-15556 published?
- CVE-2025-15556 was published on 2026-02-03 and last updated on 2026-06-17.
References
- https://community.notepad-plus-plus.org/topic/27298/notepad-v8-8-9-vulnerability-fix
- https://github.com/notepad-plus-plus/notepad-plus-plus/commit/bcf2aa68ef414338d717e20e059459570ed6c5ab
- https://github.com/notepad-plus-plus/wingup/commit/ce0037549995ed0396cc363544d14b3425614fdb
- https://notepad-plus-plus.org/news/hijacked-incident-info-update/
- https://www.vulncheck.com/advisories/notepad-plus-plus-wingup-updater-lacks-update-integrity-verification
- https://notepad-plus-plus.org//news//clarification-security-incident/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-15556
Affected products (1)
- cpe:2.3:a:notepad-plus-plus:notepad\+\+:*:*:*:*:*:*:*:*
More vulnerabilities in Notepad-plus-plus Notepad++
- CVE-2026-52884 — High (CVSS 7.8): Notepad++ is a free and open-source source code editor. In v8.9.6.1, isInTrustedDirectory() does NOT canonicalize the…
- CVE-2026-48800 — High (CVSS 7.8): Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <Command> tag text content inside…
- CVE-2026-48778 — High (CVSS 7.8): Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <GUIConfig name="commandLineInterpreter">…
- CVE-2026-46710 — High (CVSS 7.8): Notepad++ is a free and open-source source code editor. From 8.9.4 until 8.9.6, Notepad++ contains a local privilege…
- CVE-2023-47452 — High (CVSS 7.8): An Untrusted search path vulnerability in notepad++ 6.5 allows local users to gain escalated privileges through the…
- CVE-2023-40031 — High (CVSS 7.8): Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to heap buffer write…
All CVEs affecting Notepad-plus-plus Notepad++ →
Other CWE-494 vulnerabilities
- CVE-2020-1595 — Critical (CVSS 9.9): <p>A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly protected from…
- CVE-2020-1210 — Critical (CVSS 9.9): <p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source…
- CVE-2026-42248 — Critical (CVSS 9.8): Ollama for Windows does not perform integrity or authenticity verification of downloaded update executables. Unlike…
- CVE-2026-34841 — Critical (CVSS 9.8): Bruno is an open source IDE for exploring and testing APIs. Prior to 3.2.1, Bruno was affected by a supply chain attack…
- CVE-2026-3000 — Critical (CVSS 9.8): IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated…
- CVE-2026-2999 — Critical (CVSS 9.8): IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated…