CVE-2025-7073

10.12.2025, 10:16

A local privilege escalation vulnerability in Bitdefender Total Security 27.0.46.231 allows low-privileged attackers to elevate privileges. The issue arises from bdservicehost.exedeleting files from a user-writable directory (C:\ProgramData\Atc\Feedback) without proper symbolic link validation, enabling arbitrary file deletion. This issue is chained with a file copy operation during network events and a filter driver bypass via DLL injection to achieve arbitrary file copy and code execution as elevated user.

Link Following

Provider	Type	Base Score	Vector
NIST	NIST	UNKNOWN	---
Bitdefender	CNA	---	---
CISA-ADP	ADP	---	---

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Common Weakness Enumeration

CWE-59 - Improper Link Resolution Before File Access ('Link Following')
The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Vulnerability Media Exposure

[GERMAN] Bitdefender Antivirus, Total Security und Internet Security: Schwachstelle ermöglicht Privilegieneskalation
Ein lokaler Angreifer kann eine Schwachstelle in Bitdefender Antivirus, Bitdefender Total Security und Bitdefender Internet Security ausnutzen, um seine Berechtigungen zu erweitern. Die Schwachstelle kann mit anderen Schwachstellen kombiniert werden, um Codeausführungen mit erweiterten Berechtigungen und das Kopieren beliebiger Dateien zu erreichen.
Published: 2025-12-09T23:00:00+00:00

References

https://www.bitdefender.com/support/security-advisories/local-privilege-escalation-via-arbitrary-file-operation-in-bitdefender-atc-va-12590