Trend Micro CVE-2025-49385

Real-world risk is MODERATE-TO-HIGH despite the 7.8 CVSS score: (1) Attack Vector is Local (AV:L), requiring pre-existing system access—eliminates remote exploitation but affects all multi-user or compromised systems. (2) Attack Complexity is Low (AC:L), meaning no special conditions or race conditions are needed; a straightforward link placement suffices. (3) Privileges Required is Low (PR:L), so a guest, service account, or unprivileged user can exploit this. (4) No user interaction (UI:N) is required—pure automation possible. (5) Confidentiality, Integrity, and Availability are all High (C:H/I:H/A:H), meaning full compromise of protected data and system stability. EPSS score is likely elevated given the simplicity and lack of complex preconditions. However, KEV/active exploitation status is unknown from provided data; if not in CISA KEV, this suggests either recent disclosure or low real-world attention. The lack of a public POC lowers immediate mass-exploitation risk but does not change the underlying severity for targeted attacks. This should be prioritized for patching in any environment with multi-user access or where unprivileged accounts run untrusted code.

A non-administrator user on a Windows workstation (e.g., guest account, unprivileged service account, or compromised low-privilege user) wishes to disable Trend Micro Security to run malware. The attacker creates a symbolic link or NTFS junction in a user-writable directory (e.g., %TEMP% or %APPDATA%) pointing to a critical Trend Micro system file or driver (e.g., tmsfilter.sys or a core DLL). When a scheduled Trend Micro maintenance task, auto-update process, or user-initiated action (no user interaction required per the CVSS vector) attempts to access, update, or clean up files, it follows the attacker's link and deletes the legitimate privileged file instead of the intended target. This results in Trend Micro becoming non-functional, allowing the attacker to subsequently execute malware without security intervention. No public POC is known, so the attacker would need to reverse-engineer the exact file paths and operations, but the low AC:L and AC complexity suggest this is straightforward once the vulnerability is understood.