CVE-2017-10950

High

Published: 29/08/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

CVE-2017-10950 allows local attackers to execute arbitrary code on vulnerable installations of Bitdefender Total Security 21.0.24.62. The issue arises from the lack of validating the existence of an object before performing operations on it.

Risk Assessment

An attacker with low-privileged access could exploit this vulnerability to execute code in the context of SYSTEM, posing a serious security risk to the system.

Recommendation

It is recommended to update to the latest version of Bitdefender Total Security to mitigate this vulnerability and to monitor systems for potential exploitation attempts.

Other vulnerabilities in Bitdefender Total Security 21.0.24.62

CVE-2025-7073High
A local privilege escalation vulnerability in Bitdefender Total Security versions prior to 27.0.47.241 allows low-privileged attackers to elevate privileges. The issue arises from bdservicehost.exe deleting files from a user-writable directory without proper symbolic link validation.

Original NVD description (English source)

This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of Bitdefender Total Security 21.0.24.62. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within processing of the 0x8000E038 IOCTL in the bdfwfpf driver. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker could leverage this vulnerability to execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-4776.