CVE-2025-71215
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A time-of-check time-of-use vulnerability in the Trend Micro Apex One (mac) agent iCore service signature verification could allow a local attacker to escalate privileges. The attacker must first execute low-privileged code.
Risk Assessment
A local attacker could escalate privileges, potentially leading to full system control.
Recommendation
Update the agent to SaaS 2507 or 2005 Yearly Release (fixes already available).
Other vulnerabilities in Trend Micro Apex One (mac) agent
Original NVD description (English source)
A time-of-check time-of-use vulnerability in the Trend Micro Apex One (mac) agent iCore service signature verification could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The following information is provided as informational only for CVE references, as these were addressed already via ActiveUpdate/SaaS updates in mid to late 2025 (SaaS 2507 & 2005 Yearly Release).