CVE-2026-4546 - Flos Freeware Notepad2 TextShaping.dll uncontrolled search path

Back Back to CVE browser

HIGH

Flos Freeware Notepad2 TextShaping.dll uncontrolled search path

Published Mar 22, 2026

7.3

HIGH

CVSS 4.0

EPSS 0.21%

Description

A weakness has been identified in Flos Freeware Notepad2 4.2.25. This impacts an unknown function in the library TextShaping.dll. Executing a manipulation can lead to uncontrolled search path. The attack is restricted to local execution. The attack requires a high level of complexity. The exploitability is said to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Vendor Flos Freeware Product Notepad2 Default
n/a
- Version
  4.2.25
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Flos Freeware

Notepad2

n/a

Version	Status	Constraints
4.2.25	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-426

CWE-427

References (5)

https://drive.google.com/file/d/1w5-ztNIN28mPuidtjlsilKsKKQQNOiIJ/view
relatedPermissions Required
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-14303
Advisory
https://vuldb.com/?ctiid.352373
signaturepermissions-requiredPermissions Required
https://vuldb.com/?id.352373
vdb-entryThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.774778
third-party-advisoryExploitThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://drive.google.com/file/d/1w5-ztNIN28mPuidtjlsilKsKKQQNOiIJ/view		relatedPermissions Required
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-14303		Advisory
https://vuldb.com/?ctiid.352373		signaturepermissions-requiredPermissions Required
https://vuldb.com/?id.352373		vdb-entryThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.774778		third-party-advisoryExploitThird Party AdvisoryVDB Entry