Description (CNA)
Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside malicious modules / DLL that sets the process working directory to the job file's folder when a victim clicks on the file, resulting in code execution at the victim's privilege level. Fixed in 1.6.0.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Newell Brands / DYMO ID | affected 1.5.1.71 before 1.6.0; unaffected 1.6.0 |
CWE
CWE-668, CWE-22
References
- https://mediaserver.newellrubbermaid.com/industrial/Help/win/en/Content/What's%20New.htm
- https://www.dymo.com/support?cfid=user-guide
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-275-01.json
- https://www.cve.org/CVERecord?id=CVE-2026-102262
ADP enrichment
No English description supplied.
No references supplied.