PT-2026-8315 · Flos+1 · Notepad2+1

Cyber-Wo0Dy · Published 2026-02-16 · Updated 2026-02-21 · CVE-2026-2538

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Flos Freeware Notepad2 versions 4.2.22 through 4.2.25

Description A security flaw exists in Flos Freeware Notepad2. The issue involves an uncontrolled search path within an unknown function in the Msimg32.dll library. Local access is required for exploitation, and the exploitability is considered difficult.

Recommendations Update Flos Freeware Notepad2 to a version newer than 4.2.25.

Fix

Untrusted Search Path

Uncontrolled Search Path Element

Weakness Enumeration

CWE-426

CWE-427

Related Identifiers

CVE-2026-2538

Affected Products

Msimg32.Dll

Notepad2

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-2538 · Security Note
• https://vuldb.com/?submit.749345 · Note
• https://twitter.com/VulmonFeeds/status/2023308753353822607 · Twitter Post
• https://t.me/cveNotify/152089 · Telegram Post
• https://twitter.com/cracbot/status/2025163633236607062 · Twitter Post
• https://github.com/Cyber-Wo0dy/report/blob/main/notepad2/4.2.25/notepad2_dll_hijacking.md · Note
• https://twitter.com/CVEnew/status/2023302241537454227 · Twitter Post
• https://vuldb.com/?id.346126 · Note
• https://twitter.com/cracbot/status/2024801265692405818 · Twitter Post
• https://t.me/CVEtracker/44794 · Telegram Post
• https://vuldb.com/?ctiid.346126 · Note