What is the CVSS score of EUVD-2025-18562?

EUVD-2025-18562 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Trend Micro are affected by EUVD-2025-18562?

Trend Micro Security 17.8 contains a local privilege escalation vulnerability that allows low-privileged users to delete critical system files, potentially disabling security protections on affected…. A patch is available.

How to fix or mitigate EUVD-2025-18562?

Within 24 hours: Identify all systems running Trend Micro Security 17.8 and verify current patch level. Within 7 days: Apply the available vendor patch to all affected endpoints; coordinate with endpoint management to prioritize systems with multiple local user accounts. Within 30 days: Complete patch deployment across the entire Trend Micro 17.8 installed base and validate successful installation via endpoint reporting.

Trend Micro EUVD-2025-18562

| CVE-2025-49384 HIGH

Windows Shortcut Following (.LNK) (CWE-64)

2025-06-17 security@trendmicro.com

Privilege Escalation Trend Micro Path Traversal Maximum Security 2022

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:37 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

17.8.1464

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18562

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 21:15 nvd

HIGH 7.8

DescriptionCVE.org

Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend Micro files including its own.

AnalysisAI

Local privilege escalation vulnerability in Trend Micro Security 17.8 (Consumer) that exploits improper link following (symlink/junction attack) to allow a low-privileged local attacker to delete privileged Trend Micro system files without user interaction. This vulnerability carries a CVSS 7.8 high severity rating due to high impact on confidentiality, integrity, and availability; however, real-world exploitability depends on KEV status, EPSS probability data, and proof-of-concept availability, which are not provided in the available intelligence.

Technical ContextAI

The vulnerability stems from CWE-64 (Improper Link Following), a classic privilege escalation weakness where an application fails to properly validate symbolic links (symlinks) or Windows junction points before performing file operations with elevated privileges. Trend Micro Security 17.8 (Consumer) likely performs maintenance, cleanup, or update operations with SYSTEM/elevated privileges without canonicalizing paths or checking for link attacks. An attacker with local user access can create malicious symbolic links pointing to protected Trend Micro files or system directories, causing the privileged Trend Micro process to unintentionally delete or modify critical security enforcement files. The CWE-64 weakness is well-established in privilege escalation attack chains and commonly exploited in Windows environments where file permissions and link-following semantics can be abused. CPE for affected product: cpe:2.3:a:trendmicro:security:17.8:*:*:*:consumer:*:*:* (inferred from description).