CVE-2025-10214
BaseFortify
Publication date: 2025-09-10
Last updated on: 2025-09-11
Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| updf | pdf_editor | 1.8.5.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-427 | The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a DLL search path hijacking issue in the UPDF.exe executable for Windows version 1.8.5.0. An attacker with local access can place a malicious FREngine.dll file in the directory 'C:\Users\<user>\AppData\Local\UPDF\FREngine\Bin64\'. When UPDF.exe runs, it may load this malicious DLL instead of the legitimate one, allowing the attacker to execute arbitrary code on the system and maintain persistence. [1]
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker with local access to execute arbitrary code on your system with the privileges of the UPDF.exe process. This could lead to unauthorized actions such as installing malware, stealing data, or maintaining persistent access to your system. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if a malicious or unexpected FREngine.dll file exists in the directory 'C:\Users\<user>\AppData\Local\UPDF\FREngine\Bin64\'. You can use commands like 'dir C:\Users\<user>\AppData\Local\UPDF\FREngine\Bin64\FREngine.dll' on Windows to verify the presence and properties of the DLL file. Additionally, monitoring for unusual file creation or modification in this directory may help detect exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting local user access to the directory 'C:\Users\<user>\AppData\Local\UPDF\FREngine\Bin64\' to prevent unauthorized placement of DLL files. Avoid running UPDF.exe with elevated privileges and monitor the directory for unexpected DLL files. Since no patch or solution has been reported yet, applying strict access controls and user privilege limitations are recommended to reduce the risk of exploitation. [1]