CVE-2019-17100: Untrusted Search Path vulnerability in Bitdefender Total Security 2020 (VA-5895)

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-01-27 · updated 2026-06-17
Weakness: CWE-426

Description

An Untrusted Search Path vulnerability in bdserviceshost.exe as used in Bitdefender Total Security 2020 allows an attacker to execute arbitrary code. This issue does not affect: Bitdefender Total Security versions prior to 24.0.12.69.

Affected products

Bitdefender Total Security 2020: before 24.0.12.69 — fixed in 24.0.12.69

How to fix

Upgrade to a fixed version: Bitdefender Total Security 2020 24.0.12.69. Check the vendor advisory for mitigations.

References

https://www.bitdefender.com/support/security-advisories/untrusted-search-path-vulnerability-bitdefender-total-security-2020-va-5895/
https://www.bitdefender.com/support/security-advisories/untrusted-search-path-vulnerability-bitdefender-total-security-2020-va-5895/

Get alerted when CVE-2019-17100 or the next vulnerability affects your stack