What is the CVSS score of CVE-2025-67905?

CVE-2025-67905 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Malwarebytes AdwCleaner are affected by CVE-2025-67905?

Malwarebytes AdwCleaner contains a privilege escalation vulnerability (CVE-2025-67905) that allows non-administrative users to gain SYSTEM-level access through symbolic link exploitation.

How to fix or mitigate CVE-2025-67905?

Within 24 hours: Identify all systems running Malwarebytes AdwCleaner and restrict its use to administrative accounts only; disable scheduled execution if enabled. Within 7 days: Evaluate replacing AdwCleaner with alternative security tools or uninstall if not business-critical; implement application whitelisting to prevent unauthorized execution. Within 30 days: Complete migration away from AdwCleaner or upgrade immediately upon vendor patch release; conduct privilege escalation assessments on affected systems.

Malwarebytes AdwCleaner CVE-2025-67905

HIGH

Improper Privilege Management (CWE-269)

2026-02-17 cve@mitre.org

Privilege Escalation

8.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 17, 2026 - 17:21 nvd

HIGH 8.7

DescriptionCVE.org

Malwarebytes AdwCleaner before v.8.7.0 runs as Administrator and performs an insecure log file delete operation in which the target location is user-controllable, allowing a non-admin user to escalate privileges to SYSTEM via a symbolic link, a related issue to CVE-2023-28892. To exploit this, an attacker must create a file in a given folder path and intercept the application log file deletion flow.

AnalysisAI

Technical ContextAI

Classified as CWE-269 (Improper Privilege Management). Malwarebytes AdwCleaner before v.8.7.0 runs as Administrator and performs an insecure log file delete operation in which the target location is user-controllable, allowing a non-admin user to escalate privileges to SYSTEM via a symbolic link, a related issue to CVE-2023-28892. To exploit this, an attacker must create a file in a given folder path and intercept the application log file deletion flow.

Affected ProductsAI

Malwarebytes AdwCleaner before v.8.7.0 runs as Administrator and performs an insecure log file delete operation in which the target location is user-c