CVE-2026-102262

Received Received - Intake

Code Execution in DYMO ID Software via Malicious Job File

Publication date: 2026-10-05

Last updated on: 2026-10-05

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description

Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside malicious modules / DLL that sets the process working directory to the job file's folder when a victim clicks on the file, resulting in code execution at the victim's privilege level. Fixed in 1.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-05

Last Modified

2026-10-05

Generated

2026-10-06

AI Q&A

2026-10-06

EPSS Evaluated

N/A

NVD

CVE-2026-102262

Affected Vendors & Products

Vendor	Product	Version / Range
Newell	Brands	DYMO ID 1.5.1.71

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-668	The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

Attack-Flow Graph

Executive Summary

This vulnerability in Newell Brands DYMO ID 1.5.1.71 involves relative path resolution for plugin modules. An attacker can create a malicious job file that, when opened, sets the process working directory to its own folder. This allows the attacker to execute arbitrary code at the victim's privilege level by placing malicious modules or DLLs in the same directory.

Detection Guidance

Detecting this vulnerability requires checking for outdated DYMO ID software versions and monitoring for suspicious job files or modules in the Modules directory. Review installed software versions and compare them against the fixed version 1.6.0. Inspect directories where DYMO ID stores job files or modules for unexpected DLLs or executables.

Impact Analysis

If you open a malicious job file, an attacker could execute code on your system with your current privileges. This could lead to data theft, system compromise, or further malware installation. The impact depends on your user permissions and system configuration.

Compliance Impact

This vulnerability could lead to unauthorized code execution on a victim's system, potentially exposing sensitive data. This may violate GDPR's data protection requirements if personal data is accessed or HIPAA's security rules if protected health information is compromised.

Mitigation Strategies

Update Newell Brands DYMO ID to version 1.6.0 or later to address the vulnerability. Avoid opening untrusted job files or modules until the update is applied.

Hi! I’m here to help you understand CVE-2026-102262. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70