CVE-2025-4455

HIGH EPSS 12.4%

Published May 9, 20251y ago · Modified Jun 17, 20262w ago

7.3 CVSS 4.0

High

Published May 9, 2025 1y ago

Last Modified Jun 17, 2026 2w ago

Description

A vulnerability was found in Patch My PC Home Updater up to 5.1.3.0. It has been rated as critical. This issue affects some unknown processing in the library advapi32.dll/BCrypt.dll/comctl32.dll/crypt32.dll/dwmapi.dll/gdi32.dll/gdiplus.dll/imm32.dll/iphlpapi.dll/kernel32.dll/mscms.dll/msctf.dll/ntdll.dll/ole32.dll/oleaut32.dll/PresentationNative_cor3.dll/secur32.dll/shcore.dll/shell32.dll/sspicli.dll/System.IO. The manipulation leads to uncontrolled search path. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Details

Base Score

7.3

Exploitability

—

Impact

—

Vector string

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector Local

Attack Complexity High

Privileges Required Low

User Interaction None

Scope X

Threat Intelligence

EPSS Exploit Probability

12.4% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 2

CWE-426

CWE-427

References 4

gist.github.com https://gist.github.com/shellkraft/d7db265b53115d52a4ca5bffe5e9c6e4
vuldb.com https://vuldb.com/?ctiid.308069
vuldb.com https://vuldb.com/?id.308069
vuldb.com https://vuldb.com/?submit.562440

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.