Vulnerability · Published Dec 10, 2025 · Assigned by Bitdefender
CVE-2025-7073Local Privilege Escalation via Arbitrary File Operation in Bitdefender Total Security
High 8.8
In plain English
A high-severity security flaw in Antivirus Plus from Bitdefender. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).
Official description
A local privilege escalation vulnerability in Bitdefender Total Security versions prior to 27.0.47.241 allows low-privileged attackers to elevate privileges. The issue arises from bdservicehost.exe deleting files from a user-writable directory (C:\ProgramData\Atc\Feedback) without proper symbolic link validation, enabling arbitrary file deletion. This issue is chained with a file copy operation during network events and a filter driver bypass via DLL injection to achieve arbitrary file copy and code execution as elevated user.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Bitdefender | Total Security | 0 – before 27.0.47.241 |
| Bitdefender | Internet Security | 0 – before 27.0.47.241 |
| Bitdefender | Antivirus Plus | 0 – before 27.0.47.241 |
Weakness: CWE-59 · Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H