CVE-2025-13919CWE-427

Component Object Model (COM) Hijacking in Symantec Endpoint Protection Windows Client

Medium · published January 28, 2026

CVSS v3.1
4.4
EPSS
0%
Percentile
3.4
In the wild
Unconfirmed
What it is

Symantec Endpoint Protection, prior to 14.3 RU10 Patch 1, RU9 Patch 2, and RU8 Patch 3, may be susceptible to a COM Hijacking vulnerability, which is a type of issue whereby an attacker attempts to establish persistence and evade detection by hijacking COM references in the Windows Registry.

The record
Technical detail
CVSS v3.1
4.4 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00145 · 3.4th percentile
Weakness
CWE-427 · Uncontrolled Search Path Element
Published
2026-01-28T16:41Z
EPSS history
Timeline
  • 28 JAN 16:41Z
    Component Object Model (COM) Hijacking in Symantec Endpoint Protection Windows Client
    cvelistv5