ZDI-CAN-28089 HIGH 7.8 Overdue Oct 29, 2025

Trend Micro

Trend Micro, a major cybersecurity software vendor, has a high-severity local privilege escalation vulnerability (CVSS 7.8) that requires low-level user access with no user interaction to achieve complete system compromise including data theft and integrity violations. The vulnerability poses significant risk to organizations running Trend Micro products, as authenticated local attackers can exploit it to gain elevated privileges and full system control. Security teams should monitor Trend Micro's patch releases closely and prioritize updating affected systems before the February 2026 vendor deadline to prevent potential lateral movement and data exfiltration in their environments.

Advisory Details
Researcher Discovered by: Lays (@_L4ys) of TRAPA Security
Reported October 29, 2025
Deadline February 26, 2026 49d overdue
CVSS Vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy