What is the CVSS score of CVE-2025-49385?

CVE-2025-49385 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Trend Micro are affected by CVE-2025-49385?

Trend Micro Security 17.8 contains a local privilege escalation vulnerability that allows low-privileged users to delete critical security files, potentially disabling endpoint protection on consumer…. A patch is available.

How to fix or mitigate CVE-2025-49385?

Within 24 hours: identify all systems running Trend Micro Security 17.8 via asset inventory or endpoint management console. Within 7 days: apply vendor-released patch to all identified installations; verify patch deployment through compliance reporting. Within 30 days: audit systems for unauthorized deletion of Trend Micro files and conduct full security control reassessment on affected endpoints.

Trend Micro CVE-2025-49385

EUVD-2025-18561 HIGH

Windows Shortcut Following (.LNK) (CWE-64)

2025-06-17 security@trendmicro.com

Privilege Escalation Trend Micro Windows Maximum Security 2022

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:37 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

17.8.1464

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18561

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 21:15 nvd

HIGH 7.8

DescriptionCVE.org

Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend Micro files including its own.

AnalysisAI

Local privilege escalation vulnerability in Trend Micro Security 17.8 (Consumer) that exploits insecure link following to allow a low-privileged local attacker to delete privileged Trend Micro files, potentially compromising the security product's integrity. With a CVSS score of 7.8 and low attack complexity (AC:L), this vulnerability poses a significant risk to consumer systems where privilege escalation could disable or corrupt critical security components. No active exploitation (KEV status) or public POC has been reported at this time, but the low barrier to exploitation (local access with low privileges required) warrants prompt patching.

Technical ContextAI

The vulnerability is rooted in CWE-64 (Improper Control of Generation of Code), which in this context manifests as insecure link/symlink following. Trend Micro Security (CPE likely: cpe:2.3:a:trendmicro:security:17.8:*:*:*:consumer:*:*:*) fails to properly validate symbolic links or shortcut targets before performing file operations with elevated privileges. When a low-privileged user (PR:L) triggers file deletion or maintenance operations, the product follows attacker-controlled links to delete arbitrary privileged files owned by or trusted by Trend Micro processes running at system/administrator level. This is a classic privilege escalation via link-following, where the trust boundary between user-writable directories and privileged operations is not properly maintained.

RemediationAI

Immediate: (1) Update Trend Micro Security to version 18.0 or later (patch version not specified in provided data; consult Trend Micro support portal). (2) Verify the installed version via Control Panel > Programs and Features or Trend Micro's agent console. Interim mitigations (pending patch deployment): (3) Restrict local system access to trusted users only; disable guest accounts and limit service account privileges. (4) Audit file permissions on Trend Micro installation directories (typically C:\Program Files\Trend Micro or equivalent) to ensure they are not writable by unprivileged users. (5) Monitor for symbolic links or shortcuts in user-writable directories (%TEMP%, %APPDATA%) that target Trend Micro files. (6) Run Trend Micro services with minimal required privileges (already standard but verify). Refer to Trend Micro's official security advisory for patch download links and detailed remediation steps; this information was not included in the provided source data.