Trellix Agent EUVD-2026-100894

Requires an interactive local account (regular, non-admin user per 'Regular Users') on a host running Trellix Agent 5.8.4 with the vulnerable mfecryptc.dll present; the attacker must reach the local Trellix Agent database file. Exploitation is limited by the need for prior local authenticated access - it is not remotely exploitable (AV:L) and cannot be triggered over the network or via a victim's browser. Impact is confined to decryption/disclosure of the agent database contents; there is no direct integrity-destroying or availability impact (VI:L/VA:N). The static key being embedded in the shipped DLL means no special non-default configuration is needed - any standard 5.8.4 deployment is affected.

This is a moderate-severity information-disclosure flaw, not a top-tier emergency. The CVSS 4.0 vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires LOCAL access and at least low-level privileges - i.e., an already-authenticated regular user on a host running Trellix Agent - which substantially limits the attacker population versus a remote unauthenticated bug. The impact profile (VC:H, VI:L, VA:N) reflects that the real damage is confidentiality: a hardcoded cryptographic key (CWE-321) in mfecryptc.dll lets any local user decrypt the agent database, exposing whatever sensitive data it holds. No EPSS probability is provided, there is no CISA KEV listing, and no public proof-of-concept is referenced, so by the precision rules this is 'no public exploit identified at time of analysis.' The signals are internally consistent - a local privilege-dependent confidentiality issue with no exploitation telemetry - so there is no CVSS-vs-description conflict to resolve. The missing EPSS score means widespread-exploitation likelihood cannot be quantified from the data. Net: prioritize as a hardening/patch item for endpoints where untrusted or lower-trust users share hosts, but it does not warrant emergency out-of-band response on its own.

A regular (non-administrative) user logged into a Windows endpoint running Trellix Agent 5.8.4 locates the Trellix Agent database and uses the static key embedded in mfecryptc.dll to decrypt it, exposing protected configuration or credential data. No user interaction or elevated privileges beyond a normal local account are needed. No public exploit code is referenced in the provided data.