CVE-2025-10213
BaseFortify
Publication date: 2025-09-10
Last updated on: 2025-09-11
Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| updf | updf | 1.8.5.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-427 | The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a DLL search path hijacking issue in the UPDF.exe executable for Windows version 1.8.5.0. An attacker with local access can place a malicious dxtn.dll file in the 'C:\Users\<user>\AppData\Local\Microsoft\WindowsApps\' directory. When UPDF.exe runs, it may load this malicious DLL instead of the legitimate one, allowing the attacker to execute arbitrary code on the system.
How can this vulnerability impact me? :
The vulnerability can lead to arbitrary code execution and persistence on the affected system. This means an attacker with local access could run malicious code with the privileges of the user running UPDF.exe, potentially compromising the system, stealing data, or maintaining long-term access.