What is the CVSS score of CVE-2025-52521?

CVE-2025-52521 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Trend Micro are affected by CVE-2025-52521?

Trend Micro Security 17.8 contains a local privilege escalation flaw that permits any user on an affected system to delete or modify critical security components without authorization, potentially…. A patch is available.

How to fix or mitigate CVE-2025-52521?

Within 24 hours: Identify all endpoints running Trend Micro Security 17.8 using asset inventory or SIEM queries. Within 7 days: Apply Trend Micro's released patch to version 17.9 or later across all affected systems via your patch management platform; prioritize systems with high-value users or sensitive data access. Within 30 days: Verify patch deployment across 100% of inventory and conduct log review for any unauthorized file deletions in Trend Micro installation directories.

Trend Micro CVE-2025-52521

EUVD-2025-21040 HIGH

Windows Shortcut Following (.LNK) (CWE-64)

2025-07-10 security@trendmicro.com

Privilege Escalation Trend Micro Path Traversal Maximum Security 2022

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:28 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

17.8.1476

EUVD ID Assigned

Mar 16, 2026 - 06:52 euvd

EUVD-2025-21040

Analysis Generated

Mar 16, 2026 - 06:52 vuln.today

CVE Published

Jul 10, 2025 - 19:15 nvd

HIGH 7.8

DescriptionCVE.org

Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend Micro files including its own.

AnalysisAI

Trend Micro Security 17.8 for consumer platforms contains a local privilege escalation vulnerability via improper symlink handling (CWE-64: Improper Link Resolution Before File Access) that allows a local attacker with limited privileges to delete or modify critical Trend Micro system files without user interaction. The vulnerability affects Trend Micro Security 17.8 specifically and carries a CVSS 3.1 score of 7.8 (High) with local attack vector; KEV status, EPSS score, and active exploitation data are not provided in available sources, limiting real-world risk quantification.

Technical ContextAI

This vulnerability exploits improper symlink (symbolic link) resolution in the Trend Micro Security application's file handling routines. CWE-64 (Improper Link Resolution Before File Access / 'Link Following') occurs when an application fails to validate or safely handle symbolic links, allowing an attacker to redirect file operations to unintended locations. In this case, a local attacker with PR:L (low privileges, typically a standard user account) can create malicious symbolic links that the Trend Micro Security process—running with elevated privileges—will follow without validation. When the privileged process attempts to access or delete files it intends to manage, it inadvertently operates on attacker-controlled targets instead. This affects Trend Micro Security consumer product line, version 17.8, which typically runs with system-level or administrative privileges for antivirus and security operations. The AC:L (Low Attack Complexity) and UI:N (No User Interaction) factors indicate the exploit requires no special conditions or social engineering.

RemediationAI

IMMEDIATE: Update Trend Micro Security to the latest available version (post-17.8 patch release expected from Trend Micro; typically 17.9 or later hotfix). 2. VENDOR ADVISORY: Consult Trend Micro's official security advisory for CVE-2025-52521 at https://www.trendmicro.com/en_us/about/security.html (check support portal for specific patch details). 3. TEMPORARY MITIGATIONS (pending patch): Restrict local user account privileges where feasible; disable Trend Micro file integrity monitoring or automatic file deletion features if available in settings; monitor file system for suspicious symlink creation in Trend Micro working directories (e.g., C:\ProgramData\Trend Micro\). 4. POST-PATCH: Verify successful installation and confirm Trend Micro Security reports version post-17.8; perform a full system scan to ensure no files were tampered with during the vulnerability window.