Vulnerability · Published Aug 4, 2025 · Assigned by mitre
CVE-2025-53395
High 7.7
In plain English
A high-severity uncontrolled search path in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Official description
Paramount Macrium Reflect through 2025-06-26 allows local attackers to execute arbitrary code with administrator privileges via a crafted .mrimgx backup file and a malicious VSSSvr.dll located in the same directory. When a user with administrative privileges mounts a backup by opening the .mrimgx file, Reflect loads the attacker's VSSSvr.dll after the mount completes. This occurs because of untrusted DLL search path behavior in ReflectMonitor.exe.
Affected products (as reported)
Weakness: CWE-427 · Vector: CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:H/S:C/UI:R