CVE-2025-67905

HIGH EPSS 3.4%

Published Feb 17, 20264mo ago · Modified Jun 17, 20261w ago

8.7 CVSS 3.1

High

Published Feb 17, 2026 4mo ago

Last Modified Jun 17, 2026 1w ago

Description

Malwarebytes AdwCleaner before v.8.7.0 runs as Administrator and performs an insecure log file delete operation in which the target location is user-controllable, allowing a non-admin user to escalate privileges to SYSTEM via a symbolic link, a related issue to CVE-2023-28892. To exploit this, an attacker must create a file in a given folder path and intercept the application log file deletion flow.

CVSS Details

Base Score

8.7

Exploitability

2.0

Impact

6.0

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Attack Vector Local

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Changed

Confidentiality High

Integrity High

Availability Low

Threat Intelligence

EPSS Exploit Probability

3.4% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-269 Improper Privilege Management Authorization

References 2

malwarebytes.com https://Malwarebytes.com
malwarebytes.com https://www.malwarebytes.com/secure/cves/cve-2025-67905

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.