CVE-2025-10214: Updf DLL Hijacking RCE Vulnerability

CVE-2025-10214 Overview

CVE-2025-10214 is a DLL search path hijacking vulnerability in the UPDF.exe executable for Windows version 1.8.5.0. The flaw is classified under [CWE-427: Uncontrolled Search Path Element]. An attacker with local access can place a malicious FREngine.dll file in the user-writable directory C:\Users\<user>\AppData\Local\UPDF\FREngine\Bin64\. When UPDF loads the library, it executes the attacker-supplied code in the context of the current user. Successful exploitation leads to arbitrary code execution and can be leveraged for persistence on the affected host.

Critical Impact
Local attackers can achieve arbitrary code execution and establish persistence by planting a malicious FREngine.dll in a user-writable directory loaded by UPDF.

Affected Products

UPDF for Windows version 1.8.5.0
Installations that expose the C:\Users\<user>\AppData\Local\UPDF\FREngine\Bin64\ directory to unprivileged writes
Endpoints where UPDF is launched by users interacting with untrusted documents

Discovery Timeline

2025-09-10 - CVE-2025-10214 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10214

Vulnerability Analysis

The vulnerability stems from insecure DLL search order handling in UPDF.exe. The application resolves FREngine.dll from a per-user path under %LOCALAPPDATA%\UPDF\FREngine\Bin64\ before validating the library's integrity or origin. Because this directory resides in the user's profile, any process running as that user can write to it without elevated privileges. When UPDF starts or triggers OCR-related functionality, it loads the DLL from that location and executes its DllMain and exported entry points inside the UPDF process. This grants the attacker the same privileges as the user running UPDF.

Root Cause

The root cause is uncontrolled search path element resolution [CWE-427]. UPDF does not enforce a trusted, system-protected load path for FREngine.dll, nor does it verify a digital signature on the DLL prior to loading. Placing a DLL of the same name in the expected user-writable directory satisfies the loader, and Windows maps the attacker-controlled image into memory.

Attack Vector

Exploitation requires local access and user interaction. An attacker who can drop a file into the current user's profile — through a phishing payload, a malicious installer, a script, or a compromised low-privilege process — writes a crafted FREngine.dll to C:\Users\<user>\AppData\Local\UPDF\FREngine\Bin64\. The next time the victim launches UPDF or invokes functionality that depends on the FREngine component, the malicious DLL executes. The technique is well suited for persistence because UPDF reloads the DLL on every launch.

No public proof-of-concept code has been published for this specific issue. See the INCIBE Vulnerability Notice for the vendor-coordinated disclosure details.

Detection Methods for CVE-2025-10214

Indicators of Compromise

Presence of FREngine.dll in C:\Users\<user>\AppData\Local\UPDF\FREngine\Bin64\ that is unsigned or signed by an entity other than the UPDF vendor.
File modification timestamps on FREngine.dll that do not match the UPDF installation date.
Child processes spawned by UPDF.exe that are inconsistent with normal document-viewing activity, such as cmd.exe, powershell.exe, or rundll32.exe.

Detection Strategies

Hunt for image loads of FREngine.dll from paths beginning with C:\Users\ where the loaded module lacks a valid vendor signature.
Correlate UPDF.exe process creation with subsequent writes to %LOCALAPPDATA%\UPDF\FREngine\Bin64\ performed by non-UPDF processes.
Alert on any file creation of FREngine.dll under a user profile directory by a process other than the official UPDF installer or updater.

Monitoring Recommendations

Enable Sysmon Event ID 7 (Image Loaded) and filter for FREngine.dll loads outside the trusted Program Files installation path.
Monitor Sysmon Event ID 11 (File Create) for .dll writes under %LOCALAPPDATA%\UPDF\ from unexpected parent processes.
Forward endpoint telemetry to a centralized analytics platform to baseline UPDF library-load behavior across the fleet.

How to Mitigate CVE-2025-10214

Immediate Actions Required

Inventory all Windows endpoints running UPDF 1.8.5.0 and prioritize them for remediation.
Inspect C:\Users\<user>\AppData\Local\UPDF\FREngine\Bin64\ on every host for any pre-existing FREngine.dll and validate its signature.
Remove or quarantine unsigned or non-vendor FREngine.dll files and terminate any suspicious UPDF.exe child processes.

Patch Information

At the time of publication no fixed version has been referenced in the NVD entry. Consult the INCIBE Vulnerability Notice and the UPDF vendor for release information, and upgrade to a version later than 1.8.5.0 once a patched build is available.

Workarounds

Restrict write permissions on %LOCALAPPDATA%\UPDF\FREngine\Bin64\ so that only trusted installer or updater processes can create DLL files in that path.
Deploy Windows Defender Application Control or AppLocker policies that block execution of unsigned DLLs from user profile directories.
Limit UPDF usage to standard user accounts and restrict opening of documents from untrusted sources until a vendor patch is applied.

bash

# Configuration example: audit and lock down the vulnerable directory (PowerShell)
$path = "$env:LOCALAPPDATA\UPDF\FREngine\Bin64"
Get-ChildItem -Path $path -Filter FREngine.dll -ErrorAction SilentlyContinue |
    ForEach-Object { Get-AuthenticodeSignature $_.FullName }

# Deny write access for the current user to prevent DLL planting
icacls "$path" /deny "$($env:USERNAME):(W,M)"