Trend Micro CVE-2025-52521

The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) presents a moderate-to-high severity profile: local-only attack vector limits exposure to on-system attackers, but low complexity and no privilege escalation requirement for initial compromise reduce friction. The impact is severe: confidentiality (H), integrity (H), and availability (H) are all compromised, enabling an attacker to read, modify, or delete privileged security files, potentially disabling Trend Micro protections or causing system instability. However, without KEV (Known Exploited Vulnerability) designation, publicly available POC code, or EPSS score data, the real-world exploitation probability cannot be independently validated. The S:U (Scope: Unchanged) rating indicates no cross-boundary impacts. For SSVC contextualization: this is a privilege escalation with file system manipulation impact; if no active exploitation is confirmed (likely, given consumer product focus and disclosure date proximity), priority is moderate-to-high but not critical. Organizations should prioritize patching only if Trend Micro 17.8 is deployed in multi-user or shared-system environments where local attackers could gain initial access.

An attacker with local user access (e.g., guest account, standard unprivileged user, or compromised via separate vulnerability) monitors the Trend Micro Security application's temporary or working directory (often %ProgramData%\Trend Micro or /var/lib/trend-micro on Linux). The attacker identifies a directory or file that Trend Micro processes regularly with elevated privileges. The attacker creates a symbolic link in a writable location (e.g., user temp folder) pointing to a critical Trend Micro system file (e.g., signature database, configuration, or executable). When Trend Micro's privilege-elevated process (running as SYSTEM or root) performs routine file operations (cleanup, update, verification), it follows the symlink without validation and deletes or modifies the target, either disabling the security product or corrupting its functionality. The attacker achieves denial of service (security product unavailability) or, if the symlink points to OS-critical files, system instability. No user interaction or social engineering is required; the attack is entirely automated once the symlink is planted. POC code is not referenced as available in public sources at this time, but the simplicity of symlink exploitation (standard OS utilities: ln -s on Unix/Linux or mklink on Windows) makes practical exploitation straightforward.