Vulnerability · Published Jan 19, 2025 · Assigned by VulDB
CVE-2025-0567Epic Games Launcher Installer profapi.dll untrusted search path
Medium 4.5
In plain English
A medium-severity security flaw in Launcher from Epic Games. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Severity (CVSS 3.1)4.5Medium
Exploit odds (30 days)0.2%top 90.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability classified as problematic was found in Epic Games Launcher up to 17.2.1. This vulnerability affects unknown code in the library profapi.dll of the component Installer. The manipulation leads to untrusted search path. Attacking locally is a requirement. The complexity of an attack is rather high. The exploitation appears to be difficult.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Epic Games | Launcher | 17.2.017.2.1 |
Weakness: CWE-426 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
References
- VDB-292528 | Epic Games Launcher Installer profapi.dll untrusted search path vdb-entry
- VDB-292528 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #481104 | Epic Games Epic Games Launcher 17.2.1 OS Command Injection third-party-advisory