CVE-2025-7073CWE-59

CVE-2025-7073

High · published December 10, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
5.6
In the wild
Unconfirmed
What it is

⚡ A sneaky local privilege escalation vulnerability in Bitdefender Total Security could let low-privileged attackers gain elevated access, all thanks to some oversight in file handling! 🔥 Imagine a security guard mistakenly allowing access to a restricted area just because someone left the door ajar—this is what happens when bdservicehost.exe deletes files without checking for symbolic links. It’s like giving a thief the keys to the vault without realizing it! If exploited, an attacker could elevate their privileges, potentially allowing them to delete critical files or execute malicious code with elevated rights. This could lead to a complete compromise of the system, leaving users vulnerable and data at risk!

Put simply

Imagine a security guard mistakenly allowing access to a restricted area just because someone left the door ajar—this is what happens when bdservicehost.exe deletes files without checking for symbolic links. It’s like giving a thief the keys to the vault without realizing it! This vulnerability arises from improper symbolic link validation in Bitdefender's bdservicehost.exe component, which enables arbitrary file deletions. By chaining this flaw with DLL injection, attackers can elevate their permissions and execute code as a higher-privileged user.

What to do

If exploited, an attacker could elevate their privileges, potentially allowing them to delete critical files or execute malicious code with elevated rights. This could lead to a complete compromise of the system, leaving users vulnerable and data at risk! To safeguard against this vulnerability, upgrade to Bitdefender Total Security version 27.0.47.241 or later immediately. It’s also wise to review your folder permissions and ensure they’re set appropriately to prevent unauthorized access. 🛡️ You’ve got this! With these steps, you’ll keep your system secure and thwart any sneaky attempts to exploit this vulnerability! 💪✨

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00166 · 5.6th percentile
Weakness
CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2025-12-10T15:16Z
Affected products (5)
ProductVersionsFixed in
bitdefender/antivirus< 30.0.25.7730.0.25.77
bitdefender/antivirus_plus< 27.0.47.24127.0.47.241
bitdefender/endpoint_security_tools< 7.9.20.5157.9.20.515
bitdefender/internet_security< 27.0.47.24127.0.47.241
bitdefender/total_security< 27.0.47.24127.0.47.241
References (1)
EPSS history
Timeline
  • 10 DEC 09:46Z
    Local Privilege Escalation via Arbitrary File Operation in Bitdefender Total Security
    cvelistv5