SB2025060966 - Multiple vulnerabilities in Trend Micro Worry-Free Business Security

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Improper access control (CVE-ID: CVE-2025-49154)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper access restrictions. A local user can overwrite key memory-mapped files and escalate privileges on the system.

2) Untrusted search path (CVE-ID: CVE-2025-49487)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to usage of an untrusted search path. A local user can place a malicious binary into a specific location on the system and execute arbitrary code with escalated privileges.

Remediation

Install update from vendor's website.

References

• https://success.trendmicro.com/en-US/solution/KA-0019917
• https://success.trendmicro.com/en-US/solution/KA-0019936
• https://www.zerodayinitiative.com/advisories/ZDI-25-360/