PT-2026-27008 · Flos Freeware · Notepad2

Haehanse + 1 · Published 2026-03-22 · Updated 2026-03-22 · CVE-2026-4546

Mitre

CVSS v3.1

7.0

High

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

A weakness has been identified in Flos Freeware Notepad2 4.2.25. This impacts an unknown function in the library TextShaping.dll. Executing a manipulation can lead to uncontrolled search path. The attack is restricted to local execution. The attack requires a high level of complexity. The exploitability is said to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.

Fix

Uncontrolled Search Path Element

Untrusted Search Path

Weakness Enumeration

CWE-427

CWE-426

Related Identifiers

CVE-2026-4546

Affected Products

Notepad2

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-4546 · Security Note
• https://vuldb.com/?submit.774778 · Note
• https://drive.google.com/file/d/1w5-ztNIN28mPuidtjlsilKsKKQQNOiIJ/view · Note
• https://vuldb.com/?id.352373 · Note
• https://vuldb.com/?ctiid.352373 · Note