CVE-2025-34109
Panda Security PSEvents.exe Insecure DLL Loading Privilege Escalation
- State
- Published
- Severity
- 8.5 High
- Published
- Jul 15, 2025
- Updated
- May 15, 2026
- Reserved
- Apr 15, 2025
Description
PSEvents.exe in multiple Panda Security products runs hourly with SYSTEM privileges and loads DLL files from a user-writable directory without proper validation. An attacker with low-privileged access who can write DLL files to the monitored directory can achieve arbitrary code execution with SYSTEM privileges. Affected products include Panda Global Protection 2016, Panda Antivirus Pro 2016, Panda Small Business Protection, and Panda Internet Security 2016 (all versions up to 16.1.2).
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.5 High | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
- CWE-427 Uncontrolled Search Path Element
Affected Products
| Product | Versions |
|---|---|
Panda Global Protection 2016Panda Security |
|
Panda Antivirus Pro 2016Panda Security |
|
Panda Small Business ProtectionPanda Security |
|
Panda Internet Security 2016Panda Security |
|
References
- https://web.archive.org/web/20160704105329/http://www.pandasecurity.com/uk/support/card?id=100053vendor-advisorypatch
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/local/panda_psevents.rbexploit
- https://www.exploit-db.com/exploits/40020exploit
- https://web.archive.org/web/20170415211828/http://www.security-assessment.com/files/documents/advisory/Panda%20Security%20-%20Privilege%20Escalation.pdfthird-party-advisorytechnical-description
- https://www.vulncheck.com/advisories/panda-security-psevents-insecure-dll-loading-privilege-escalationthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.