What’s Vulnerable › Vulnerabilities

CVE-2025-67905

• Severity: high (CVSS 8.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-17 · updated 2026-06-17
• Weakness: CWE-269

Description

Malwarebytes AdwCleaner before v.8.7.0 runs as Administrator and performs an insecure log file delete operation in which the target location is user-controllable, allowing a non-admin user to escalate privileges to SYSTEM via a symbolic link, a related issue to CVE-2023-28892. To exploit this, an attacker must create a file in a given folder path and intercept the application log file deletion flow.

References

• https://Malwarebytes.com
• https://www.malwarebytes.com/secure/cves/cve-2025-67905

Get alerted when CVE-2025-67905 or the next vulnerability affects your stack