What is the CVSS score of EUVD-2025-18119?

EUVD-2025-18119 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Windows are affected by EUVD-2025-18119?

CVE-2025-49148 is a DLL hijacking vulnerability in ClipShare Server for Windows that allows local users with write access to the application directory to execute arbitrary code and escalate…. A patch is available.

How to fix or mitigate EUVD-2025-18119?

Within 24 hours: Inventory all systems running ClipShare Server and identify current versions; assess directory permissions on ClipShare installation paths to determine exploit feasibility. Within 7 days: Upgrade ClipShare Server to version 3.8.5 or later on all affected systems; verify installation directory permissions restrict write access to administrators only. Within 30 days: Audit access logs for suspicious DLL creation attempts in ClipShare directories; document remediation completion and establish change control to prevent future version downgrades.

Windows EUVD-2025-18119

| CVE-2025-49148 HIGH

Uncontrolled Search Path Element (CWE-427)

2025-06-11 security-advisories@github.com

Windows Privilege Escalation RCE Microsoft

7.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.3 HIGH

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:39 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

3.8.5

EUVD ID Assigned

Mar 14, 2026 - 21:09 euvd

EUVD-2025-18119

Analysis Generated

Mar 14, 2026 - 21:09 vuln.today

CVE Published

Jun 11, 2025 - 15:15 nvd

HIGH 7.3

DescriptionGitHub Advisory

ClipShare is a lightweight and cross-platform tool for clipboard sharing. Prior to 3.8.5, ClipShare Server for Windows uses the default Windows DLL search order and loads system libraries like CRYPTBASE.dll and WindowsCodecs.dll from its own directory before the system path. A local, non-privileged user who can write to the folder containing clip_share.exe can place malicious DLLs there, leading to arbitrary code execution in the context of the server, and, if launched by an Administrator (or another elevated user), it results in a reliable local privilege escalation. This vulnerability is fixed in 3.8.5.

AnalysisAI

DLL hijacking vulnerability in ClipShare Server for Windows (versions prior to 3.8.5) that allows local, non-privileged users to achieve arbitrary code execution and potential privilege escalation by placing malicious DLLs in the application directory. The vulnerability exploits Windows' default DLL search order, where the application directory is searched before system paths, and poses a reliable privilege escalation risk when ClipShare is run by elevated users. This is a local attack requiring write access to the installation directory.

Technical ContextAI

This vulnerability exploits CWE-427 (Uncontrolled Search Path Element), a class of weaknesses where applications load dynamic libraries from untrusted locations without proper validation. ClipShare Server for Windows uses the standard Windows DLL search order, which prioritizes the executable's directory over system directories. The vulnerability specifically involves system libraries like CRYPTBASE.dll and WindowsCodecs.dll, which are legitimately called by the application but loaded insecurely. The affected product is ClipShare (CPE: software/clipshare), specifically the Windows Server component versions before 3.8.5. The root cause is improper DLL search path configuration and lack of explicit full-path DLL loading or manifest-based DLL redirection controls.

RemediationAI

Upgrade to ClipShare version 3.8.5 or later; priority: Critical for systems running ClipShare under elevated privileges; verification: Verify version via Help > About or command line: clip_share.exe --version Access Control Mitigation: Restrict write permissions on the ClipShare installation directory to Administrator users only. Set NTFS ACLs to remove Users/Everyone write access.; command_example: icacls 'C:\Program Files\ClipShare' /inheritance:r /grant:r 'SYSTEM:(OI)(CI)F' /grant:r 'Administrators:(OI)(CI)F'; priority: High - immediate workaround while awaiting patch Deployment Hardening: Install ClipShare to a directory with restricted write permissions (not Program Files if possible, or ensure NTFS ACLs are enforced). Avoid installing to user-writable directories.; priority: Medium - preventative measure for new deployments Monitoring: Monitor for unexpected DLL files (CRYPTBASE.dll, WindowsCodecs.dll) appearing in the ClipShare installation directory. Alert on any file modifications in the installation directory.; priority: Medium - detective control