What’s Vulnerable › Vulnerabilities
CVE-2025-7073: Local Privilege Escalation via Arbitrary File Operation in Bitdefender Total Security
- Severity: high (CVSS 7.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-12-10 · updated 2026-10-14
- Weakness: CWE-59
Description
A local privilege escalation vulnerability in Bitdefender Total Security versions prior to 27.0.47.241 allows low-privileged attackers to elevate privileges. The issue arises from bdservicehost.exe deleting files from a user-writable directory (C:\ProgramData\Atc\Feedback) without proper symbolic link validation, enabling arbitrary file deletion. This issue is chained with a file copy operation during network events and a filter driver bypass via DLL injection to achieve arbitrary file copy and code execution as elevated user.
Affected products
- Bitdefender Antivirus for Mac: before 30.0.25.77 — fixed in 30.0.25.77
- Bitdefender Antivirus Plus: before 27.0.47.241 — fixed in 27.0.47.241
- Bitdefender Endpoint Security Tools: before 7.9.20.515 — fixed in 7.9.20.515
- Bitdefender Internet Security: before 27.0.47.241 — fixed in 27.0.47.241
- Bitdefender Total Security: before 27.0.47.241 — fixed in 27.0.47.241
How to fix
Upgrade to a fixed version: Bitdefender Antivirus for Mac 30.0.25.77; Bitdefender Antivirus Plus 27.0.47.241; Bitdefender Endpoint Security Tools 7.9.20.515; Bitdefender Internet Security 27.0.47.241; Bitdefender Total Security 27.0.47.241. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-7073 or the next vulnerability affects your stack