Vulnerability · Published Jul 18, 2025 · Assigned by ESET
CVE-2025-2425TOCTOU race condition vulnerability in ESET products on Windows
Medium 5.1
In plain English
A medium-severity security flaw in ESET Endpoint Antivirus for Windows from ESET, spol. s.r.o. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).
Severity (CVSS 4.0)5.1Medium
Exploit odds (30 days)0.1%top 98.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Time-of-check to time-of-use race condition vulnerability potentially allowed an attacker to use the installed ESET security software to clear the content of an arbitrary file on the file system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ESET, spol. s.r.o | ESET NOD32 Antivirus | 0 – through 18.1.13.0 |
| ESET, spol. s.r.o | ESET Internet Security | 0 – through 18.1.13.0 |
| ESET, spol. s.r.o | ESET Smart Security Premium | 0 – through 18.1.13.0 |
| ESET, spol. s.r.o | ESET Security Ultimate | 0 – through 18.1.13.0 |
| ESET, spol. s.r.o | ESET Endpoint Antivirus for Windows | 0 – through 12.0.2049.00 – through 11.1.2059.0 |
| ESET, spol. s.r.o | ESET Endpoint Security for Windows | 0 – through 12.0.2049.00 – through 11.1.2059.0 |
| ESET, spol. s.r.o | ESET Small Business Security | 0 – through 18.1.13.0 |
| ESET, spol. s.r.o | ESET Safe Server | 0 – through 18.1.13.0 |
| ESET, spol. s.r.o | ESET Server Security for Windows Server | 0 – through 12.0.12004.00 – through 11.1.12009.1 |
| ESET, spol. s.r.o | ESET Mail Security for Microsoft Exchange Server | 0 – through 12.0.10003.00 – through 11.1.10011.0 |
| ESET, spol. s.r.o | ESET Security for Microsoft SharePoint Server | 0 – through 12.0.15004.00 – through 11.1.15003.0 |
Weakness: CWE-367 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N