CVE-2025-53395

Paramount Macrium Reflect through 2025-06-26 allows local attackers to execute arbitrary code with administrator privileges via a crafted .mrimgx backup file…

High · published August 4, 2025

CVSS v3.1
7.7
EPSS
0%
Percentile
5.4
In the wild
Unconfirmed
What it is

Paramount Macrium Reflect through 2025-06-26 allows local attackers to execute arbitrary code with administrator privileges via a crafted .mrimgx backup file and a malicious VSSSvr.dll located in the same directory. When a user with administrative privileges mounts a backup by opening the .mrimgx file, Reflect loads the attacker's VSSSvr.dll after the mount completes. This occurs because of untrusted DLL search path behavior in ReflectMonitor.exe.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:H/S:C/UI:R
CVSS v4.0
Not supplied
EPSS
0.00165 · 5.4th percentile
Published
2025-08-04T00:00Z
EPSS history
Timeline
  • 04 AUG 00:00Z
    Paramount Macrium Reflect through 2025-06-26 allows local attackers to execute arbitrary code with administrator privileges via a crafted .mrimgx backup file…
    cvelistv5