CVE-2025-7073 PUBLISHED

Local Privilege Escalation via Arbitrary File Operation in Bitdefender Total Security

Assigner: Bitdefender
Reserved: 04.07.2025 Published: 10.12.2025 Updated: 26.02.2026

A local privilege escalation vulnerability in Bitdefender Total Security 27.0.46.231 allows low-privileged attackers to elevate privileges. The issue arises from bdservicehost.exe deleting files from a user-writable directory (C:\ProgramData\Atc\Feedback) without proper symbolic link validation, enabling arbitrary file deletion. This issue is chained with a file copy operation during network events and a filter driver bypass via DLL injection to achieve arbitrary file copy and code execution as elevated user.

Metrics

CVSS Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS Score: 8.8

Product Status

Vendor Bitdefender
Product Total Security
Versions Default: unaffected
  • affected from 0 to 27.10.45.497 (excl.)
Vendor Bitdefender
Product Internet Security
Versions Default: unaffected
  • affected from 0 to 27.10.45.497 (excl.)
Vendor Bitdefender
Product Antivirus Plus
Versions Default: unaffected
  • affected from 0 to 27.10.45.497 (excl.)

Solutions

An automatic update to product version 27.10.45.497 fixes the issue

Credits

  • Filip Dragovic (@filip_dragovic) finder

References

Problem Types

  • CWE-59 Improper Link Resolution Before File Access ('Link Following') CWE

Impacts

  • CAPEC-132 Symlink Attack