CVE-2025-10215 — DLL search path hijacking vulnerability

CVE-2025-10215

DLL search path hijacking vulnerability PUBLISHED

Description (CNA)

DLL search path hijacking vulnerability in the UPDF.exe executable for Windows version 1.8.5.0 allows attackers with local access to execute arbitrary code by placing a FREngine.dll file of their choice in the 'C:\Users\Public\AppData\Local\UPDF\FREngine\Bin64\' directory, which could lead to arbitrary code execution and persistence.

Affected (CNA)

Vendor / product	Versions
UPDF / UPDF	affected 1.8.5.0

CWE

CWE-427

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-updf

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.