ZDI-CAN-28077 HIGH 7.8 Overdue Oct 29, 2025

Trend Micro

Trend Micro, a major cybersecurity software vendor, has a high-severity local privilege escalation vulnerability (CVSS 7.8) that requires local access and low-level user privileges to exploit, but once successful grants complete system compromise including confidentiality, integrity, and availability breaches. The attack requires no user interaction, making it particularly dangerous in multi-user or shared system environments. Security teams should prioritize monitoring for this vulnerability once patches release on or before February 26, 2026, and ensure immediate deployment to systems running Trend Micro products, especially in environments with untrusted local users.

Advisory Details
Researcher Discovered by: Lays (@_L4ys) of TRAPA Security
Reported October 29, 2025
Deadline February 26, 2026 49d overdue
CVSS Vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy