EUVD-2025-18562

The vulnerability stems from CWE-64 (Improper Link Following), a classic privilege escalation weakness where an application fails to properly validate symbolic links (symlinks) or Windows junction points before performing file operations with elevated privileges. Trend Micro Security 17.8 (Consumer) likely performs maintenance, cleanup, or update operations with SYSTEM/elevated privileges without canonicalizing paths or checking for link attacks. An attacker with local user access can create malicious symbolic links pointing to protected Trend Micro files or system directories, causing the privileged Trend Micro process to unintentionally delete or modify critical security enforcement files. The CWE-64 weakness is well-established in privilege escalation attack chains and commonly exploited in Windows environments where file permissions and link-following semantics can be abused. CPE for affected product: cpe:2.3:a:trendmicro:security:17.8:*:*:*:consumer:*:*:* (inferred from description).