Read the docs
TI-2025-04507 Aliases CVE-2025-5028GHSA-w765-6g68-fxf9

Arbitrary file deletion vulnerability in ESET product installers

Priority LOW 31CWE-269Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

Installation file of ESET security products on Windows allow an attacker to misuse to delete an arbitrary file without having the permissions to do so.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00147 3rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ESET, spol. s r.o.ESET NOD32 Antivirusup to 18.1.13.0—No fix listedCNA
ESET, spol. s r.o.ESET Internet Securityup to 18.1.13.0—No fix listedCNA
ESET, spol. s r.o.ESET Smart Security Premiumup to 18.1.13.0—No fix listedCNA
ESET, spol. s r.o.ESET Security Ultimateup to 18.1.13.0—No fix listedCNA
ESET, spol. s r.o.ESET Endpoint Antivirus for Windowsup to 12.0.2049.0; up to 11.1.2059.0—No fix listedCNA
ESET, spol. s r.o.ESET Endpoint Security for Windowsup to 12.0.2049.0; up to 11.1.2059.0—No fix listedCNA
ESET, spol. s r.o.ESET Small Business Securityup to 18.1.13.0—No fix listedCNA
ESET, spol. s r.o.ESET Safe Serverup to 18.1.13.0—No fix listedCNA
  • ESET NOD32 Antivirus VendorESET, spol. s r.o. Affected up to 18.1.13.0 Fixed in — No fix listed CNA
  • ESET Internet Security VendorESET, spol. s r.o. Affected up to 18.1.13.0 Fixed in — No fix listed CNA
  • ESET Smart Security Premium VendorESET, spol. s r.o. Affected up to 18.1.13.0 Fixed in — No fix listed CNA
  • ESET Security Ultimate VendorESET, spol. s r.o. Affected up to 18.1.13.0 Fixed in — No fix listed CNA
  • ESET Endpoint Antivirus for Windows VendorESET, spol. s r.o. Affected up to 12.0.2049.0; up to 11.1.2059.0 Fixed in — No fix listed CNA
  • ESET Endpoint Security for Windows VendorESET, spol. s r.o. Affected up to 12.0.2049.0; up to 11.1.2059.0 Fixed in — No fix listed CNA
  • ESET Small Business Security VendorESET, spol. s r.o. Affected up to 18.1.13.0 Fixed in — No fix listed CNA
  • ESET Safe Server VendorESET, spol. s r.o. Affected up to 18.1.13.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-5028
  2. 2026-10-03 Alias added: GHSA-w765-6g68-fxf9

References

Other 1

  • TI-2012-01283 The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus… CVSS 2.0MEDIUM 4.3
  • TI-2012-01281 The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir… CVSS 2.0MEDIUM 4.3
  • TI-2012-01279 The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast!… CVSS 2.0MEDIUM 4.3
  • TI-2012-01278 The TAR file parser in AVG Anti-Virus 10.0.0.1190, Quick Heal (aka Cat QuickHeal) 11.00… CVSS 2.0MEDIUM 4.3
  • TI-2012-01265 The RAR file parser in ClamAV 0.96.4, Rising Antivirus 22.83.00.03, Quick Heal (aka Cat… CVSS 2.0MEDIUM 4.3
  • TI-2012-01244 The TAR file parser in Quick Heal (aka Cat QuickHeal) 11.00, NOD32 Antivirus 5795, Norman… CVSS 2.0MEDIUM 4.3
See all 60 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences