EUVD-2025-18531CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H
Lifecycle Timeline
6DescriptionNVD
An insecure access control vulnerability in Trend Micro Apex One and Trend Micro Worry-Free Business Security could allow a local attacker to overwrite key memory-mapped files which could then have severe consequences for the security and stability of affected installations.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
AnalysisAI
CVE-2025-49154 is an insecure access control vulnerability (CWE-284) in Trend Micro Apex One and Worry-Free Business Security that allows a local attacker with low-privileged code execution to overwrite critical memory-mapped files, potentially compromising system security and stability. With a CVSS score of 8.7 and low attack complexity, this vulnerability poses a significant risk to enterprise security postures, though exploitation requires prior code execution access. No active KEV confirmation or public POC availability is documented in standard vulnerability databases at this time.
Technical ContextAI
This vulnerability stems from improper access control mechanisms protecting memory-mapped files used by Trend Micro's endpoint security solutions. Memory-mapped files are a Windows mechanism where file contents are mapped directly into process address space, often used for inter-process communication and shared data access. CWE-284 (Improper Access Control - Permissions, Privileges, and Other Access Controls) indicates that Trend Micro Apex One and Worry-Free Business Security fail to properly restrict write access to these critical security-sensitive files. The affected technology involves kernel-level or privileged service components that should restrict file modification to authenticated, high-privileged contexts but instead allow low-privileged local processes to modify them. This likely affects security decision-making files, configuration stores, or threat intelligence caches that the security software relies upon for protection mechanisms.
RemediationAI
Patch Management: Apply the latest security updates from Trend Micro for both Apex One and Worry-Free Business Security as released in their official security advisories. Consult Trend Micro's security bulletin portal for specific patch versions and release dates. Workarounds: (1) Restrict local code execution privileges using Windows AppLocker, Software Restriction Policies, or third-party endpoint application control to prevent low-privileged attackers from executing arbitrary code; (2) Run user applications in sandboxed or containerized environments; (3) Implement strict principle-of-least-privilege for user accounts. Monitoring: Enable audit logging on file access to memory-mapped security files and monitor for unauthorized modification attempts. Post-remediation verification should confirm that file permissions on critical Trend Micro-managed files (typically in C:\Program Files\Trend Micro\ or AppData directories) are properly restricted.
Share
External POC / Exploit Code
Leaving vuln.today