Trend Micro EUVD-2025-21041

The CVSS 7.8 (High) rating is justified by the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, which reflects local attack vector, low complexity, low privilege requirement, no user interaction needed, and high impact across confidentiality, integrity, and availability. However, real-world exploitation probability depends on several factors: (1) Password Manager must be running with sufficient privileges to delete files outside user scope, (2) Attacker requires local system access and valid user credentials, (3) Predictable file operation patterns must exist. The privilege escalation impact is significant if the application runs as SYSTEM or in a privileged context, but limited if confined to user-level operations. Without confirmed KEV status, active exploitation metrics, or publicly available proof-of-concept code, this should be prioritized as a moderate-to-high local threat requiring patch deployment, particularly for systems where Password Manager runs with elevated privileges. Organizations using this product should treat this as important but not emergency-critical unless additional exploitation evidence emerges.

An authenticated local user with standard user privileges identifies that Trend Micro Password Manager performs file deletion or cleanup operations during startup or scheduled maintenance. The attacker identifies a predictable file path that the Password Manager accesses with elevated privileges (e.g., a lock file, temp database, or configuration file). The attacker creates a symbolic link at that path pointing to a critical system file or administrator-owned file. When Password Manager next runs and attempts to delete this 'safe' maintenance file, it follows the symlink and deletes the attacker's chosen target instead. By repeating this process with symlinks pointing to Windows system files (e.g., drivers, services configurations, or admin user files), the attacker can destabilize the system, disable security features, or manipulate service configurations to achieve privilege escalation. No user interaction is required from the perspective of the Password Manager process, making this a reliable local privilege escalation vector if exploitation conditions are met.