CVE-2026-2538 Overview
CVE-2026-2538 is a DLL hijacking vulnerability affecting Flos Freeware Notepad2 versions 4.2.22, 4.2.23, 4.2.24, and 4.2.25. The flaw resides in how the application loads the Msimg32.dll library, resulting in an uncontrolled search path element [CWE-426]. An attacker with local access can place a malicious Msimg32.dll in a location searched before the legitimate system library, causing Notepad2 to load attacker-controlled code. The vendor was contacted prior to public disclosure but did not respond. Exploitation requires local access and is rated high in attack complexity.
Critical Impact
Successful exploitation allows arbitrary code execution within the context of the Notepad2 process, compromising confidentiality, integrity, and availability on the affected host.
Affected Products
- Flos Freeware Notepad2 4.2.22
- Flos Freeware Notepad2 4.2.23
- Flos Freeware Notepad2 4.2.24 and 4.2.25
Discovery Timeline
- 2026-02-16 - CVE-2026-2538 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2026-2538
Vulnerability Analysis
The vulnerability is a classic Windows DLL search-order hijacking issue classified under [CWE-426] Untrusted Search Path. Notepad2 references functions from Msimg32.dll, a Windows GDI helper library, without enforcing a fully qualified path or a safe search mode. When the application starts, Windows searches several directories for the DLL, beginning with the application's own directory. An attacker who can write to that directory, or who controls the working directory used to launch Notepad2, can drop a malicious Msimg32.dll that exports the expected symbols. When Notepad2 loads the rogue library, attacker-supplied code executes with the privileges of the user running the editor.
Root Cause
The root cause is improper library loading. Notepad2 calls into Msimg32.dll without using SetDefaultDllDirectories, LoadLibraryEx with LOAD_LIBRARY_SEARCH_SYSTEM32, or an absolute path to %SystemRoot%\System32\Msimg32.dll. Because Windows resolves unqualified DLL names through the standard search order, any DLL placed alongside the Notepad2 executable takes precedence over the legitimate system copy.
Attack Vector
Exploitation requires local access. An attacker stages a crafted Msimg32.dll in the directory containing Notepad2.exe or in another directory positioned earlier in the DLL search order. When a user launches Notepad2, the malicious library is loaded and its DllMain or exported stubs execute attacker code. Refer to the GitHub PoC Repository and VulDB #346126 for further technical details. EPSS data places the current exploitation probability at a low value, consistent with the local-access requirement and high attack complexity.
Detection Methods for CVE-2026-2538
Indicators of Compromise
- Presence of Msimg32.dll in the Notepad2 installation directory or any user-writable directory used to launch Notepad2.exe.
- Unexpected child processes spawned by Notepad2.exe, such as cmd.exe, powershell.exe, or rundll32.exe.
- Msimg32.dll files outside of %SystemRoot%\System32 that are unsigned or signed by an unexpected publisher.
Detection Strategies
- Monitor image load events (Sysmon Event ID 7) for Notepad2.exe loading Msimg32.dll from paths other than C:\Windows\System32.
- Hunt for file creation events where Msimg32.dll is written to directories containing user-installed applications.
- Alert on Notepad2 loading any unsigned DLL or a DLL whose signature does not chain to Microsoft.
Monitoring Recommendations
- Enable Sysmon with image-load and file-create logging across endpoints running Notepad2.
- Forward endpoint telemetry to a centralized analytics platform and correlate DLL load paths with known-good baselines.
- Track process lineage from Notepad2.exe and flag deviations from typical editor behavior.
How to Mitigate CVE-2026-2538
Immediate Actions Required
- Inventory all hosts running Flos Freeware Notepad2 versions 4.2.22 through 4.2.25.
- Remove any unexpected Msimg32.dll files from Notepad2 installation directories and user download folders.
- Restrict write permissions on the Notepad2 installation directory to administrators only.
- Consider replacing Notepad2 with an actively maintained editor until a vendor fix is available.
Patch Information
No vendor patch is available at the time of publication. According to the VulDB advisory, the vendor was contacted prior to disclosure and did not respond. Organizations should track the GitHub PoC Repository and vendor channels for future updates.
Workarounds
- Install Notepad2 only in directories protected by administrative ACLs, such as C:\Program Files.
- Do not launch Notepad2 from directories controlled by untrusted users, including Downloads or removable media.
- Apply AppLocker or Windows Defender Application Control rules that block loading of unsigned DLLs by Notepad2.exe.
- Configure the system-wide CWDIllegalInDllSearch registry value to remove the current working directory from the DLL search order.
# Configuration example: harden DLL search order system-wide
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v CWDIllegalInDllSearch /t REG_DWORD /d 0xFFFFFFFF /f
# Restrict write access on the Notepad2 install directory
icacls "C:\Program Files\Notepad2" /inheritance:r /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "Users:(OI)(CI)RX"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
