CVE-2026-102262
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside malicious modules / DLL that sets the process working directory to the job file's folder when a victim clicks on the file, resulting in code execution at the victim's privilege level.
Risk Assessment
A local attacker can execute arbitrary code with the victim's privileges, potentially leading to compromise of the system and user data.
Recommendation
Update DYMO ID to version 1.6.0, where the vulnerability is fixed.
Other vulnerabilities in DYMO ID
Original NVD description (English source)
Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside malicious modules / DLL that sets the process working directory to the job file's folder when a victim clicks on the file, resulting in code execution at the victim's privilege level. Fixed in 1.6.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS