CVE-2026-4545 Details

A vulnerability exists in Flos Freeware Notepad2 version 4.2.25, specifically within an unknown function of the PROPSYS.dll library. This flaw creates an uncontrolled search path vulnerability, allowing local attackers to manipulate the DLL loading process. The issue arises because the application fails to securely load system DLLs by using relative paths or by properly managing the default Windows DLL search order. As a result, an attacker could place a malicious PROPSYS.dll in a directory that is prioritized over the legitimate System32 path. When Notepad2 loads the DLL, the malicious code is executed within the Notepad2 process, potentially leading to arbitrary code execution with the user's privileges.