CVE-2025-10213 Overview
CVE-2025-10213 is a DLL search path hijacking vulnerability in UPDF version 1.8.5.0 for Windows. The flaw exists in the UPDF.exe executable, which loads a dxtn.dll library from a user-writable directory before checking trusted system locations. Attackers with local access can place a malicious dxtn.dll in C:\Users\<user>\AppData\Local\Microsoft\WindowsApps\ to achieve arbitrary code execution under the user's context. Successful exploitation enables code execution and persistence on the affected host. The vulnerability is tracked under CWE-427: Uncontrolled Search Path Element.
Critical Impact
A local attacker who plants a rogue dxtn.dll in the WindowsApps user directory gains arbitrary code execution and persistence whenever UPDF launches.
Affected Products
- UPDF for Windows version 1.8.5.0
- Vendor: UPDF (updf)
- Platform: Microsoft Windows
Discovery Timeline
- 2025-09-10 - CVE-2025-10213 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-10213
Vulnerability Analysis
The vulnerability stems from insecure DLL search order behavior in UPDF.exe. When the application starts, it attempts to resolve dxtn.dll using Windows' default search sequence. Because C:\Users\<user>\AppData\Local\Microsoft\WindowsApps\ is present in the user's PATH on modern Windows installations and is writable by the current user, the loader can be tricked into loading an attacker-supplied library from that path. UPDF does not validate the origin or signature of dxtn.dll before mapping it into the process.
Once loaded, the malicious DLL executes with the same privileges as the UPDF process. This provides an execution primitive suitable for both code execution and persistence, since the malicious DLL is invoked every time the user opens UPDF.
Root Cause
The root cause is an uncontrolled search path element [CWE-427]. UPDF.exe relies on Windows' default library resolution instead of specifying a fully qualified path or applying SetDefaultDllDirectories to restrict loader search behavior to trusted system directories.
Attack Vector
Exploitation requires local access to the target account and user interaction to launch UPDF. An attacker with the ability to write to the user's WindowsApps folder drops a crafted dxtn.dll that exports the symbols UPDF expects. When the victim starts UPDF.exe, the planted library is loaded, and its DllMain or hijacked exports run attacker-controlled code.
The vulnerability manifests during process initialization. Refer to the INCIBE Security Notice for the coordinated advisory and additional technical context.
Detection Methods for CVE-2025-10213
Indicators of Compromise
- Presence of dxtn.dll in C:\Users\<user>\AppData\Local\Microsoft\WindowsApps\ that is unsigned or not issued by a trusted vendor.
- UPDF.exe process loading a dxtn.dll module from a user profile path instead of the UPDF installation directory under Program Files.
- Unexpected child processes or outbound network connections spawned by UPDF.exe shortly after launch.
Detection Strategies
- Hunt for image load events (Sysmon Event ID 7) where UPDF.exe loads dxtn.dll from any path outside the vendor install directory.
- Alert on file creation events (Sysmon Event ID 11) that write dxtn.dll into AppData\Local\Microsoft\WindowsApps\.
- Correlate DLL load events with signature verification failures to surface unsigned or self-signed hijack payloads.
Monitoring Recommendations
- Baseline the legitimate module list for UPDF.exe and flag deviations across the fleet.
- Monitor writes to WindowsApps directories, which are typically reserved for Microsoft Store package aliases and should rarely contain arbitrary DLLs.
- Review endpoint telemetry for persistence patterns tied to UPDF launches at user logon.
How to Mitigate CVE-2025-10213
Immediate Actions Required
- Inventory endpoints running UPDF 1.8.5.0 for Windows and prioritize remediation on multi-user or shared systems.
- Remove any unauthorized dxtn.dll files from C:\Users\<user>\AppData\Local\Microsoft\WindowsApps\ after forensic capture.
- Restrict interactive logon and local write access on high-value workstations until a patched build is deployed.
Patch Information
No vendor patch URL is listed in the NVD entry at publication. Consult the INCIBE Security Notice and the UPDF vendor site for updated builds beyond version 1.8.5.0, and upgrade as soon as a fixed release is available.
Workarounds
- Block or remove the writable WindowsApps entry from the user PATH where it is not required for Microsoft Store aliases.
- Apply application allowlisting (for example, Windows Defender Application Control or AppLocker) to prevent unsigned DLLs from loading into UPDF.exe.
- Enforce least privilege so standard users cannot introduce DLLs into directories referenced by trusted applications.
# Configuration example: AppLocker DLL rule to block unsigned dxtn.dll from user profile paths
New-AppLockerPolicy -RuleType Deny -User Everyone -Path "%LOCALAPPDATA%\Microsoft\WindowsApps\dxtn.dll" -RuleNamePrefix "Block-UPDF-DLL-Hijack"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
