What is the CVSS score of CVE-2026-2538?

CVE-2026-2538 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Flos Freeware Notepad2 are affected by CVE-2026-2538?

A HIGH severity vulnerability (CVE-2026-2538) affects Notepad2 versions 4.2.22 through 4.2.25, potentially allowing unauthorized code execution through a flaw in the Msimg32.dll library.

How to fix or mitigate CVE-2026-2538?

Within 24 hours: Identify and inventory all systems running Notepad2 versions 4.2.22-4.2.25 across the organization. Within 7 days: Isolate or restrict usage of affected versions to non-critical functions, communicate findings to end users, and implement compensating controls. Within 30 days: Downgrade to Notepad2 4.2.21 or earlier, transition to alternative text editors, or monitor vendor communications for patch availability.

Flos Freeware Notepad2 CVE-2026-2538

HIGH

Untrusted Search Path (CWE-426)

2026-02-16 cna@vuldb.com

Privilege Escalation

7.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 16, 2026 - 07:17 nvd

HIGH 7.0

DescriptionCVE.org

A security flaw has been discovered in Flos Freeware Notepad2 4.2.22/4.2.23/4.2.24/4.2.25. Affected is an unknown function in the library Msimg32.dll. Performing a manipulation results in uncontrolled search path. Attacking locally is a requirement. The attack's complexity is rated as high. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Flos Freeware Notepad2 versions 4.2.22 through 4.2.25 contain an uncontrolled search path vulnerability in Msimg32.dll that allows local attackers with user-level privileges to achieve code execution and system compromise. Exploitation requires high complexity and local access, but successful attacks can result in complete system confidentiality, integrity, and availability breaches. No patch is currently available, and the vendor has not responded to disclosure attempts.

Technical ContextAI

Classified as CWE-426 (Untrusted Search Path). A security flaw has been discovered in Flos Freeware Notepad2 4.2.22/4.2.23/4.2.24/4.2.25. Affected is an unknown function in the library Msimg32.dll. Performing a manipulation results in uncontrolled search path. Attacking locally is a requirement. The attack's complexity is rated as high. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.