CVE-2025-49385

Published Jun 17, 2025

Last updated 2 months ago

Trend Micro Security

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-49385 is a local privilege escalation vulnerability affecting Trend Micro Security 17.8 (Consumer). It stems from a link following issue within the Platinum Host Service. A local attacker can exploit this vulnerability by creating a symbolic link, which the service then follows, leading to the deletion of privileged Trend Micro files. This could allow the attacker to escalate their privileges and execute arbitrary code within the SYSTEM context.

Description: Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend Micro files including its own.
Source: security@trendmicro.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

security@trendmicro.com: CWE-64

Hype score: Not currently trending

References