Flos Freeware Notepad2 CVE-2026-2538
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocal attacker manipulates search path
-
ExploitMsimg32.dll loads malicious library
-
ImpactArbitrary code execution in Notepad2 process context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V13 - Configuration Search path verification
|
| Exploitation Conditions | Local access required with low-level user privileges. Notepad2 versions 4.2.22–4.2.25 must be installed. Attacker must control DLL search path manipulation via unprotected directory or environment variable accessible to low-privilege user account. |
| Impact | CVSS 7.0 (HIGH). Attack vector: Local. Complexity: High. Privileges required: Low. User interaction: None. Exploitable via local access. |
| Exploit ScenarioDerived | An attacker could exploit this flaw, uncontrolled search path. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Flos Freeware Notepad2 versions 4.2.22 through 4.2.25 contain an uncontrolled search path vulnerability in Msimg32.dll that allows local attackers with user-level privileges to achieve code execution and system compromise. Exploitation requires high complexity and local access, but successful attacks can result in complete system confidentiality, integrity, and availability breaches. No patch is currently available, and the vendor has not responded to disclosure attempts.
Earlier versions of this analysis (1)
A security flaw has been discovered in Flos Freeware Notepad2 4.2.22/4.2.23/4.2.24/4.2.25. Affected is an unknown function in the library Msimg32.dll. [CVSS 7.0 HIGH]
RemediationAI
Monitor vendor advisories for a patch.
Affected ProductsAI
A security flaw has been discovered in Flos Freeware Notepad2 4.2.22/4.2.23/4.2.24/4.2.25
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-426 (Untrusted Search Path). A security flaw has been discovered in Flos Freeware Notepad2 4.2.22/4.2.23/4.2.24/4.2.25. Affected is an unknown function in the library Msimg32.dll. Performing a manipulation results in uncontrolled search path. Attacking locally is a requirement. The attack's complexity is rated as high. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
A security flaw has been discovered in Flos Freeware Notepad2 4.2.22/4.2.23/4.2.24/4.2.25. Affected is an unknown function in the library Msimg32.dll. Performing a manipulation results in uncontrolled search path. Attacking locally is a requirement. The attack's complexity is rated as high. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
A HIGH severity vulnerability (CVE-2026-2538) affects Notepad2 versions 4.2.22 through 4.2.25, potentially allowing unauthorized code execution through a flaw in the Msimg32.dll library. Organizations using this software face risk of data compromise and system infiltration if the vulnerability is exploited; immediate inventory and mitigation actions are required as no patch is currently available.
Disable Notepad2 installation via application whitelisting controls; restrict file types that can be opened with Notepad2; implement network segmentation to limit lateral movement if compromise occurs; monitor file system and registry changes on systems running affected versions; consider deploying alternative text editors (Notepad++, VS Code) as substitutes; apply principle of least privilege to user accounts running Notepad2.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB