Read the docs
TI-2023-06625 Aliases CVE-2023-7241GHSA-4v4w-p37f-qvm2

Webroot Antivirus COM-Hijacking LPE

Priority LOW 34CWE-269Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

Privilege Escalation in WRSA.EXE in Webroot Antivirus 8.0.1X- 9.0.35.12 on Windows64 bit and 32 bit allows malicious software to abuse WRSA.EXE to delete arbitrary and protected files.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00186 8th percentileScored 2026-11-07
Fix Fixed Webroot AntiVirus (Consumer) and Webroot Endpoint Protection (Business) (Webroot): 9.0.35.17

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WebrootWebroot AntiVirus (Consumer) and Webroot Endpoint Protection (Business)8.0.1 to before 9.0.35.179.0.35.17Patch availableCNA
  • Webroot AntiVirus (Consumer) and Webroot Endpoint Protection (Business) VendorWebroot Affected 8.0.1 to before 9.0.35.17 Fixed in 9.0.35.17 Patch available CNA

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:webroot:anti-virus-and-endpoint-protection:-:*:*:*:*:*:*:*not specified by CISA-ADP—Webroot
  • cpe:2.3:a:webroot:anti-virus-and-endpoint-protection:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Webroot

Remediation

  • Fix · CNA Webroot AntiVirus (Consumer) and Webroot Endpoint Protection (Business) (Webroot) Fixed in 9.0.35.17

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-7241
  2. 2026-10-03 Alias added: GHSA-4v4w-p37f-qvm2

References

Other 3

  • TI-2021-17488 Out-of-bounds read in Webroot Secure Anywhere CVSS 3.1MEDIUM 6.5
  • TI-2021-17487 Out-of-bounds read in Webroot Secure Anywhere CVSS 3.1MEDIUM 6.5
  • TI-2023-14033 An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and… CVSS 3.1MEDIUM 5.5
  • TI-2018-02980 Memory corruption in Webroot CVSS 3.0CRITICAL 9.0
  • TI-2024-07251 Unhandled exception vulnerability that can cause the WRSA.exe service to crash and generate a crash dump CVSS 3.1CRITICAL 9.8
  • TI-2024-07250 Type confusion that can cause the WRSA.exe service to crash and generate a crash dump CVSS 3.1CRITICAL 9.8
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences