CVE-2025-7073
HighSummary
A local privilege escalation vulnerability in Bitdefender Total Security versions prior to 27.0.47.241 allows low-privileged attackers to elevate privileges. The issue arises from bdservicehost.exe deleting files from a user-writable directory without proper symbolic link validation.
Risk Assessment
This vulnerability allows attackers to gain elevated privileges, potentially leading to unauthorized access to the system and data. Consequently, it may threaten the integrity and confidentiality of information within the organization.
Recommendation
It is recommended to update Bitdefender Total Security to version 27.0.47.241 or later to mitigate this vulnerability. Additionally, conducting a permissions audit and monitoring file activities in critical locations is advisable.
Other vulnerabilities in Bitdefender Total Security
Original NVD description (English source)
A local privilege escalation vulnerability in Bitdefender Total Security versions prior to 27.0.47.241 allows low-privileged attackers to elevate privileges. The issue arises from bdservicehost.exe deleting files from a user-writable directory (C:\ProgramData\Atc\Feedback) without proper symbolic link validation, enabling arbitrary file deletion. This issue is chained with a file copy operation during network events and a filter driver bypass via DLL injection to achieve arbitrary file copy and code execution as elevated user.