Vulnerability · Published Jan 28, 2026 · Assigned by symantec
CVE-2025-13919Component Object Model (COM) Hijacking in Symantec Endpoint Protection Windows Client
Medium 4.4
In plain English
A medium-severity uncontrolled search path in Symantec Endpoint Protection Windows Client from Broadcom. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).
Severity (CVSS 3.1)4.4Medium
Exploit odds (30 days)0.1%top 96.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Symantec Endpoint Protection, prior to 14.3 RU10 Patch 1, RU9 Patch 2, and RU8 Patch 3, may be susceptible to a COM Hijacking vulnerability, which is a type of issue whereby an attacker attempts to establish persistence and evade detection by hijacking COM references in the Windows Registry.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Broadcom | Symantec Endpoint Protection Windows Client | 14.3.12154.10000 |
Weakness: CWE-427 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L