CVE-2025-32780CWE-427

BleachBit for Windows Has DLL Untrusted Path Vulnerability

High · published April 15, 2025

CVSS v3.1
7.3
EPSS
0%
Percentile
14.6
In the wild
Unconfirmed
What it is

BleachBit cleans files to free disk space and to maintain privacy. BleachBit for Windows up to version 4.6.2 is vulnerable to a DLL Hijacking vulnerability. By placing a malicious DLL with the name uuid.dll in the folder C:\Users\<username>\AppData\Local\Microsoft\WindowsApps\, an attacker can execute arbitrary code every time BleachBit is run. This issue has been patched in version 4.9.0.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00243 · 14.6th percentile
Weakness
CWE-427 · Uncontrolled Search Path Element
Published
2025-04-15T16:32Z
EPSS history
Timeline
  • 15 APR 16:32Z
    BleachBit for Windows Has DLL Untrusted Path Vulnerability
    cvelistv5