CVE-2025-10215
BaseFortify
Publication date: 2025-09-10
Last updated on: 2025-09-11
Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| updf | pdf_editor | 1.8.5.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-427 | The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a DLL search path hijacking issue in the UPDF.exe executable for Windows version 1.8.5.0. It allows an attacker with local access to execute arbitrary code by placing a malicious FREngine.dll file in the 'C:\Users\Public\AppData\Local\UPDF\FREngine\Bin64\' directory. When UPDF.exe loads this DLL, the attacker's code is executed, potentially leading to persistence on the system.
How can this vulnerability impact me? :
This vulnerability can allow an attacker with local access to execute arbitrary code on your system, which could lead to unauthorized actions, compromise of system integrity, and persistence of malicious code. This could result in loss of control over the affected system and potential further exploitation.