CVE-2025-15556: Notepad++ Download of Code Without Integrity Check Vulnerability

Notepad++ contains a vulnerability in its WinGUp update mechanism that allows an attacker to intercept or redirect update traffic. The result is that an attacker-controlled installer can be downloaded and executed with the privileges of the current user, leading to arbitrary code execution on affected systems.

How it works

The weakness is categorized as CWE-494, download of code without integrity check. When the application uses its built-in updater, it retrieves installer files over the network without verifying that the received content matches an expected cryptographic hash or signature. An attacker positioned to manipulate network traffic can therefore substitute a malicious binary that the updater will execute.

Am I affected? How to find it in your systems

Notepad++ installations that rely on the WinGUp updater component are exposed to this class of update-channel tampering. Inventory desktop and server endpoints for the presence of Notepad++ and examine whether the updater is enabled or has been invoked recently. Check installed application metadata and configuration files for updater settings. Because exact version or configuration details are not provided here, confirm the precise conditions that trigger the flaw against the vendor advisory.

• Review endpoint management or software inventory tools for Notepad++ entries.
• Examine local logs or telemetry for WinGUp process activity and any unexpected network destinations during update checks.
• Correlate user-reported update failures or unexpected installer executions with the affected application.

How to remediate

Apply mitigations per the vendor instructions. Where an update addressing the integrity-check weakness is supplied, deploy it through standard software-distribution channels and verify successful installation. After patching, confirm that the updater now performs integrity validation on downloaded content. If the advisory indicates that certain configurations remain unsupported, remove or disable the updater feature entirely.

If you can't patch immediately

Until a fix can be applied, reduce exposure by restricting outbound network access for the Notepad++ process to only trusted update servers through host-based firewall rules or network segmentation. Monitor for anomalous child processes spawned by the updater and for unexpected binaries appearing in temporary directories used by WinGUp. Where mitigations are unavailable, discontinue use of the product as stated in the required action guidance.

• Block or proxy update traffic through an allow-listed update server.
• Enable process-creation auditing and alert on executions originating from the updater binary.
• Consider replacing the application with an alternative that provides signed update packages.

If your data may have been exposed

Successful exploitation of this vulnerability can result in code execution and subsequent data access. Organizations should review endpoint detection logs for signs of post-exploitation activity and run a free exposure scan of their email addresses against known breach data to determine whether related credentials or information have already appeared in public records.