Trend Micro CVE-2025-49155

The vulnerability stems from CWE-427 (Uncontrolled Search Path Element), a path traversal/search path injection flaw where the Apex One DLP module fails to properly validate or sanitize the search path used for loading libraries or executable code. This class of vulnerability typically occurs when an application dynamically constructs file paths without proper canonicalization or validation, allowing attackers to inject relative paths, symbolic links, or malicious library names that the system will load from an attacker-controlled location. In the context of Trend Micro Apex One (Enterprise security/endpoint protection platform running on Windows/Linux systems), the DLP module likely uses dynamic loading mechanisms or search procedures that can be redirected to load attacker-supplied malicious code, bypassing intended security boundaries. The vulnerability is remotely triggerable (AV:N) with low attack complexity (AC:L), suggesting the search path injection can be triggered through network-accessible interfaces without complex exploit conditions.