TI-2025-02137 Aliases CVE-2025-2425 GHSA-2gx3-2m5f-vj2w

TOCTOU race condition vulnerability in ESET products on Windows

LOW 22CWE-367Published 2025-07-18 · Updated 2025-07-18

Key facts

Attack vector: Local
Privileges required: Low
User interaction: Active
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Time-of-check to time-of-use race condition vulnerability potentially allowed an attacker to use the installed ESET security software to clear the content of an arbitrary file on the file system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0012 1st percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ESET, spol. s r.o.	ESET NOD32 Antivirus	up to 18.1.13.0	—	No fix listed	CNA
ESET, spol. s r.o.	ESET Internet Security	up to 18.1.13.0	—	No fix listed	CNA
ESET, spol. s r.o.	ESET Smart Security Premium	up to 18.1.13.0	—	No fix listed	CNA
ESET, spol. s r.o.	ESET Security Ultimate	up to 18.1.13.0	—	No fix listed	CNA
ESET, spol. s r.o.	ESET Endpoint Antivirus for Windows	up to 12.0.2049.0; up to 11.1.2059.0	—	No fix listed	CNA
ESET, spol. s r.o.	ESET Endpoint Security for Windows	up to 12.0.2049.0; up to 11.1.2059.0	—	No fix listed	CNA
ESET, spol. s r.o.	ESET Small Business Security	up to 18.1.13.0	—	No fix listed	CNA
ESET, spol. s r.o.	ESET Safe Server	up to 18.1.13.0	—	No fix listed	CNA
ESET, spol. s r.o.	ESET Server Security for Windows Server	up to 12.0.12004.0; up to 11.1.12009.1	—	No fix listed	CNA
ESET, spol. s r.o.	ESET Mail Security for Microsoft Exchange Server	up to 12.0.10003.0; up to 11.1.10011.0	—	No fix listed	CNA
ESET, spol. s r.o.	ESET Security for Microsoft SharePoint Server	up to 12.0.15004.0; up to 11.1.15003.0	—	No fix listed	CNA

ESET NOD32 Antivirus VendorESET, spol. s r.o. Affected up to 18.1.13.0 Fixed in — No fix listed CNA
ESET Internet Security VendorESET, spol. s r.o. Affected up to 18.1.13.0 Fixed in — No fix listed CNA
ESET Smart Security Premium VendorESET, spol. s r.o. Affected up to 18.1.13.0 Fixed in — No fix listed CNA
ESET Security Ultimate VendorESET, spol. s r.o. Affected up to 18.1.13.0 Fixed in — No fix listed CNA
ESET Endpoint Antivirus for Windows VendorESET, spol. s r.o. Affected up to 12.0.2049.0; up to 11.1.2059.0 Fixed in — No fix listed CNA
ESET Endpoint Security for Windows VendorESET, spol. s r.o. Affected up to 12.0.2049.0; up to 11.1.2059.0 Fixed in — No fix listed CNA
ESET Small Business Security VendorESET, spol. s r.o. Affected up to 18.1.13.0 Fixed in — No fix listed CNA
ESET Safe Server VendorESET, spol. s r.o. Affected up to 18.1.13.0 Fixed in — No fix listed CNA
ESET Server Security for Windows Server VendorESET, spol. s r.o. Affected up to 12.0.12004.0; up to 11.1.12009.1 Fixed in — No fix listed CNA
ESET Mail Security for Microsoft Exchange Server VendorESET, spol. s r.o. Affected up to 12.0.10003.0; up to 11.1.10011.0 Fixed in — No fix listed CNA
ESET Security for Microsoft SharePoint Server VendorESET, spol. s r.o. Affected up to 12.0.15004.0; up to 11.1.15003.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-2425
2026-10-03 Alias added: GHSA-2gx3-2m5f-vj2w

References

Other 1

https://support.eset.com/en/ca8840-eset-customer-advisory-toctou-race-condition-vulnerability-in-eset-products-on-windows-fixed

TI-2012-01283 The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus… CVSS 2.0MEDIUM 4.3
TI-2012-01281 The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir… CVSS 2.0MEDIUM 4.3
TI-2012-01279 The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast!… CVSS 2.0MEDIUM 4.3
TI-2012-01278 The TAR file parser in AVG Anti-Virus 10.0.0.1190, Quick Heal (aka Cat QuickHeal) 11.00… CVSS 2.0MEDIUM 4.3
TI-2012-01265 The RAR file parser in ClamAV 0.96.4, Rising Antivirus 22.83.00.03, Quick Heal (aka Cat… CVSS 2.0MEDIUM 4.3
TI-2012-01244 The TAR file parser in Quick Heal (aka Cat QuickHeal) 11.00, NOD32 Antivirus 5795, Norman… CVSS 2.0MEDIUM 4.3

See all 60 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences