TrueConf Client CVE-2025-66835

Exploitation requires local access to the host and the ability to write a crafted wfapi.dll into a directory that TrueConf Client 8.5.2 includes in its DLL search order ahead of the legitimate library (per CVSS PR:L, the attacker must already hold at least low/standard-user privileges). No user interaction beyond the normal launch/loading of the TrueConf Client is needed (UI:N). Limiting factors: the attack is local-only (AV:L) and cannot be triggered over the network; it is confined to version 8.5.2; the executed code runs only in the victim user's context (S:U, no privilege escalation to SYSTEM), and success depends on the attacker having write permission to an appropriate search-path directory, which hardened ACLs would deny.

The signals are internally consistent toward a moderate, low-urgency local risk. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N scores 7.1 (High) but explicitly requires local access and existing low privileges (PR:L), with no availability impact - this is not a remotely exploitable RCE despite the 'RCE' tag. EPSS is 0.17% (6th percentile), and the CVE is NOT in CISA KEV, so there is no evidence of active or widespread exploitation. Publicly available exploit code exists, which raises opportunistic risk, but POC availability is a distinct signal from active exploitation and should not be conflated. The most notable tension is the 'RCE' tag versus the AV:L vector: this is local arbitrary code execution, not network RCE - defenders should treat it as a local code-execution/user-context compromise primitive, useful in a post-access chain rather than as an initial remote breach. No scope change (S:U) means the code runs at the victim user's privilege level, not elevated.

An attacker who already has a foothold as a low-privileged local user (or via social engineering that plants a file) writes a malicious wfapi.dll into a directory that TrueConf Client 8.5.2 searches before the legitimate one; when the victim launches or the client loads the library, the attacker's code executes in that user's context. Publicly available exploit code lowers the effort to weaponize this. Because the CVSS vector is AV:L/AC:L, exploitation is straightforward once local write access to a search-path directory is obtained.