Executive Summary

CVE-2025-71212 is a local privilege escalation vulnerability in the Trend Micro Apex One scan engine on Windows systems. It involves a link following weakness (symbolic link issue) that allows a local attacker, who already has the ability to execute low-privileged code, to escalate their privileges to a higher level, such as SYSTEM.

The vulnerability is tracked under CWE-59 and affects the Virus Scan Engine's VSApiNt.sys driver, enabling arbitrary file deletion and privilege escalation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with limited access to escalate their privileges to SYSTEM level on the affected system. This means the attacker could execute arbitrary code with the highest privileges, potentially leading to full control over the system.

Such an escalation could result in unauthorized access, modification, or deletion of files, disruption of services, and compromise of sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the CVE-2025-71212 vulnerability, you should immediately update the Trend Micro Apex One scan engine to the latest build, specifically Build 14136 or later, which contains the critical patch addressing this issue.

Since exploitation requires an attacker to already have low-privileged code execution on the system, it is also important to ensure that your systems are protected against initial code execution vulnerabilities and to monitor for suspicious activities.

Useful 0 Not Useful 0