Trend Micro CVE-2025-49384

The CVSS 7.8 score reflects high severity: Attack Vector Local (AV:L) means only authenticated local attackers qualify; Attack Complexity Low (AC:L) indicates no special conditions required; Privileges Required Low (PR:L) means standard user context suffices; User Interaction None (UI:N) indicates no social engineering needed; and the impact scope is Unchanged (S:U) with full confidentiality, integrity, and availability compromise (C:H/I:H/A:H). However, real-world risk assessment requires: (1) KEV/CISA status—if not listed as actively exploited, threat is lower; (2) EPSS probability—a high CVSS with low EPSS (<0.20) suggests theoretical rather than practical exploitation; (3) POC availability—public exploits significantly increase real-world risk; (4) Automatable damage—the vulnerability allows unintended deletion of Trend Micro files, which is damaging but may be detected/recovered, lowering impact compared to data exfiltration; (5) SSVC factors—this is a local-only attack requiring prior account compromise, placing it in a lower urgency tier than remote RCE. Without EPSS and KEV data, this appears as a legitimate but not critical local privilege escalation affecting a consumer security product; organizations should prioritize based on employee laptop/desktop exposure and whether Trend Micro 17.8 is widely deployed.

An authenticated local user on a Windows workstation with Trend Micro Security 17.8 (Consumer) installed creates a symbolic link (using mklink.exe or third-party tools) in a world-writable temp directory (e.g., C:\Users\Public\Temp or C:\Windows\Temp) pointing to a critical Trend Micro system file such as C:\Program Files\Trend Micro\Security\scan.exe or a configuration file that controls security features. When Trend Micro's privileged maintenance process (running as SYSTEM or LocalService) executes a scheduled cleanup or update routine, it follows the symlink without validation and attempts to delete or overwrite the target file. The attacker's goal is to disable Trend Micro's core scanning capabilities or delete driver files, resulting in security feature degradation or a denial-of-service condition. If a POC exists (not confirmed in available intelligence), the attack can be automated and executed within seconds after exploitation setup. The low attack complexity and requirement for only standard user privileges make this vulnerability realistically exploitable by any user with local shell access (e.g., post-compromise lateral movement, insider threats, or compromised employee accounts).