CVE-2025-15556
HIGH
7,7
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A
HIGH
7,5
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high
Description
AI Translation Available
Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically verified. An attacker able to intercept or redirect update traffic can cause the updater to download and execute an attacker-controlled installer, resulting in arbitrary code execution with the privileges of the user.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0003
Percentile
0,1th
Updated
EPSS Score Trend (Last 22 Days)
494
Download of Code Without Integrity Check
DraftCommon Consequences
Security Scopes Affected:
Integrity
Availability
Confidentiality
Other
Potential Impacts:
Execute Unauthorized Code Or Commands
Alter Execution Logic
Other
Applicable Platforms
All platforms may be affected
Application
Notepad\+\+ by Notepad-Plus-Plus
Version Range Affected
To
8.8.9
(exclusive)
CPE Identifier
View Detailed Analysis
cpe:2.3:a:notepad-plus-plus:notepad\+\+:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://notepad-plus-plus.org//news//clarification-security-incident/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025…
https://community.notepad-plus-plus.org/topic/27298/notepad-v8-8-9-vulnerabilit…
https://github.com/notepad-plus-plus/notepad-plus-plus/commit/bcf2aa68ef414338d…
https://github.com/notepad-plus-plus/wingup/commit/ce0037549995ed0396cc363544d1…
https://notepad-plus-plus.org/news/hijacked-incident-info-update/
https://www.vulncheck.com/advisories/notepad-plus-plus-wingup-updater-lacks-upd…