high7.3
CVE-2026-102262
Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory.
Impact
Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside malicious modules / DLL that sets the process working directory to the job file's folder when a victim clicks on the file, resulting in code execution at the victim's privilege level. Fixed in 1.6.0.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.
Weakness classification
References
- NVD record
- CVE.org record
- https://mediaserver.newellrubbermaid.com/industrial/Help/win/en/Content/What's%20New.htm
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-275-01.json
- https://www.cve.org/CVERecord?id=CVE-2026-102262
- https://www.dymo.com/support?cfid=user-guide