Read the docs
TI-2025-06435 Aliases CVE-2025-7073GHSA-9247-4234-vwrq

Local Privilege Escalation via Arbitrary File Operation in Bitdefender Total Security

Priority LOW 39CWE-59Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A local privilege escalation vulnerability in Bitdefender Total Security versions prior to 27.0.47.241 allows low-privileged attackers to elevate privileges. The issue arises from bdservicehost.exe deleting files from a user-writable directory (C:\ProgramData\Atc\Feedback) without proper symbolic link validation, enabling arbitrary file deletion. This issue is chained with a file copy operation during network events and a filter driver bypass via DLL injection to achieve arbitrary file copy and code execution as elevated user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00166 5th percentileScored 2026-11-07
Fix Fixed Total Security (Bitdefender): 27.0.47.241Internet Security (Bitdefender): 27.0.47.241+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
BitdefenderTotal Securitybefore 27.0.47.24127.0.47.241Patch availableCNA
BitdefenderInternet Securitybefore 27.0.47.24127.0.47.241Patch availableCNA
BitdefenderAntivirus Plusbefore 27.0.47.24127.0.47.241Patch availableCNA
  • Total Security VendorBitdefender Affected before 27.0.47.241 Fixed in 27.0.47.241 Patch available CNA
  • Internet Security VendorBitdefender Affected before 27.0.47.241 Fixed in 27.0.47.241 Patch available CNA
  • Antivirus Plus VendorBitdefender Affected before 27.0.47.241 Fixed in 27.0.47.241 Patch available CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:bitdefender:antivirus:*:*:*:*:free:*:*:*before 30.0.25.77VulnerableBitdefender
cpe:2.3:a:bitdefender:antivirus_plus:*:*:*:*:*:*:*:*before 27.0.47.241VulnerableBitdefender
cpe:2.3:a:bitdefender:endpoint_security_tools:*:*:*:*:*:windows:*:*before 7.9.20.515VulnerableBitdefender
cpe:2.3:a:bitdefender:internet_security:*:*:*:*:*:*:*:*before 27.0.47.241VulnerableBitdefender
cpe:2.3:a:bitdefender:total_security:*:*:*:*:*:*:*:*before 27.0.47.241VulnerableBitdefender
  • cpe:2.3:a:bitdefender:antivirus:*:*:*:*:free:*:*:* Versions before 30.0.25.77 Vulnerable ·Bitdefender
  • cpe:2.3:a:bitdefender:antivirus_plus:*:*:*:*:*:*:*:* Versions before 27.0.47.241 Vulnerable ·Bitdefender
  • cpe:2.3:a:bitdefender:endpoint_security_tools:*:*:*:*:*:windows:*:* Versions before 7.9.20.515 Vulnerable ·Bitdefender
  • cpe:2.3:a:bitdefender:internet_security:*:*:*:*:*:*:*:* Versions before 27.0.47.241 Vulnerable ·Bitdefender
  • cpe:2.3:a:bitdefender:total_security:*:*:*:*:*:*:*:* Versions before 27.0.47.241 Vulnerable ·Bitdefender

Remediation

  • Fix · CNA Total Security (Bitdefender) Fixed in 27.0.47.241
  • Fix · CNA Internet Security (Bitdefender) Fixed in 27.0.47.241
  • Fix · CNA Antivirus Plus (Bitdefender) Fixed in 27.0.47.241

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-7073
  2. 2026-10-03 Alias added: GHSA-9247-4234-vwrq

References

Advisory 1

  • TI-2007-05541 Unspecified vulnerability in BitDefender allows attackers to execute arbitrary code via… CVSS 3.1CRITICAL 9.8
  • TI-2008-05149 Unspecified vulnerability in the pdf.xmd module in (1) BitDefender Free Edition 10 and… CVSS 2.0HIGH 9.3
  • TI-2023-05659 Local privilege escalation in Bitdefender Total Security (VA-11168) CVSS 3.1HIGH 7.8
  • TI-2020-06515 Code Injection into Bitdefender AV for Mac CVSS 3.1HIGH 7.8
  • TI-2020-06514 Privilege escalation in Bitdefender AV for Mac CVSS 3.1MEDIUM 5.5
  • TI-2019-12759 Get-task-allow entitlement via BDLDaemon on macOS CVSS 3.1MEDIUM 5.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences