Bitdefender
CVE-2025-7073
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Symlink resolution safety
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 31, 2026
Bitdefender Total Security, Antivirus, Internet Security, and Endpoint Security Tools prior to version 27.0.47.241 allow local attackers with low privileges to execute arbitrary code as SYSTEM through a complex attack chain. The bdservicehost.exe service deletes files from C:\ProgramData\Atc\Feedback without validating symbolic links (CWE-59), enabling arbitrary file deletion that attackers chain with network-triggered file copy operations and filter driver bypass via DLL injection to achieve full privilege escalation. EPSS indicates 0.02% exploitation probability (6th percentile), and no public exploit code or active exploitation has been identified at time of analysis. Vendor has released patches addressing this multi-stage local escalation vector.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Bitdefender gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Primary rating from Vendor (bitdefender) · only source for this CVE.
CVSS VectorVendor: bitdefender
DescriptionCVE.org
A local privilege escalation vulnerability in Bitdefender Total Security versions prior to 27.0.47.241 allows low-privileged attackers to elevate privileges. The issue arises from bdservicehost.exe deleting files from a user-writable directory (C:\ProgramData\Atc\Feedback) without proper symbolic link validation, enabling arbitrary file deletion. This issue is chained with a file copy operation during network events and a filter driver bypass via DLL injection to achieve arbitrary file copy and code execution as elevated user.
Executive ViewAI
Bitdefender Total Security, Antivirus, Internet Security, and Endpoint Security Tools versions before 27.0.47.241 contain a local privilege escalation vulnerability that allows low-privileged users to execute arbitrary code with SYSTEM-level permissions through a multi-stage attack chain. This affects organizations running vulnerable Bitdefender versions on Windows endpoints and requires immediate patching to prevent lateral movement and post-compromise persistence by insider threats or malware with initial user-level access.
Within 24 hours: Inventory all Bitdefender deployments and identify systems running versions prior to 27.0.47.241 across Total Security, Antivirus, Internet Security, and Endpoint Security Tools. Within 7 days: Deploy vendor patch to version 27.0.47.241 or later to all affected systems, prioritizing high-value assets and systems with network-facing roles. Within 30 days: Complete patching of all remaining vulnerable instances and verify deployment through endpoint management tools; conduct audit of privileged access logs during vulnerability window for suspicious activity.
Vendor-released patch: version 27.0.47.241 or later. Apply vendor patch immediately. Until patching is complete, implement local access controls to restrict low-privileged user execution of network file operations and monitor C:\ProgramData\Atc\Feedback for unauthorized symbolic link creation or file operations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
More in Bitdefender
View allThe Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7,
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast!. Rated medium severity (CVSS 4.3), t
The RAR file parser in ClamAV 0.96.4, Rising Antivirus 22.83.00.03, Quick Heal (aka Cat QuickHeal) 11.00, G Data AntiVir
The installer for BitDefender GravityZone relies on an encoded string in a filename to determine the URL for installatio
An Improper Input Validation vulnerability in the Product Update feature of Bitdefender Endpoint Security Tools for Linu
Multiple directory traversal vulnerabilities in Bitdefender GravityZone before 5.1.11.432 allow remote attackers to read
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet
Improper Access Control vulnerability in the patchesUpdate API as implemented in Bitdefender Endpoint Security Tools for
A vulnerability in the sendMailFromRemoteSource method in Emails.php as used in Bitdefender GravityZone Console unsafely
A host whitelist parser issue in the proxy service implemented in the GravityZone Update Server allows an attacker to ca
GitHub PoC
Exploit-DB