CVE-2025-7073A local privilege escalation vulnerability in Bitdefender Total Security versions prior to 27.0.47.241 allows low-privileged attackers to elevate privileges.
Updated under an hour ago ()
Does this affect you?
It affects bitdefender antivirus and 4 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
A local privilege escalation vulnerability in Bitdefender Total Security versions prior to 27.0.47.241 allows low-privileged attackers to elevate privileges. The issue arises from bdservicehost.exe deleting files from a user-writable directory (C:\ProgramData\Atc\Feedback) without proper symbolic link validation, enabling arbitrary file deletion. This issue is chained with a file copy operation during network events and a filter driver bypass via DLL injection to achieve arbitrary file copy and code execution as elevated user.
- CVSS
- 7.8 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-59
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Analyzed
- Record last updated
- Oct 14, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
bitdefender antivirus bitdefender:antivirus | before 30.0.25.77 | NVD |
bitdefender antivirus_plus bitdefender:antivirus_plus | before 27.0.47.241 | NVD |
bitdefender endpoint_security_tools bitdefender:endpoint_security_tools | before 7.9.20.515 | NVD |
bitdefender internet_security bitdefender:internet_security | before 27.0.47.241 | NVD |
bitdefender total_security bitdefender:total_security | before 27.0.47.241 | NVD |
References
- https://www.bitdefender.com/support/security-advisories/local-privilege-escalation-via-arbitrary-file-operation-in-bitdefender-atc-va-12590vendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.