CVE-2025-10215: Updf DLL Hijacking RCE Vulnerability

CVE-2025-10215 Overview

CVE-2025-10215 is a DLL search path hijacking vulnerability [CWE-427] affecting UPDF version 1.8.5.0 on Windows. The UPDF.exe executable loads FREngine.dll from an insecure user-writable path, allowing a local attacker to plant a malicious DLL and execute arbitrary code in the context of the UPDF process. Successful exploitation can lead to arbitrary code execution and persistence on the affected host. INCIBE-CERT published the coordinated advisory covering this and related UPDF issues.

Critical Impact

A local attacker who can write to C:\Users\Public\AppData\Local\UPDF\FREngine\Bin64\ can place a rogue FREngine.dll that UPDF will load, achieving arbitrary code execution and a persistence foothold.

Affected Products

• UPDF for Windows version 1.8.5.0
• UPDF.exe executable component
• FREngine.dll loader path under C:\Users\Public\AppData\Local\UPDF\FREngine\Bin64\

Discovery Timeline

• 2025-09-10 - CVE-2025-10215 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10215

Vulnerability Analysis

The vulnerability stems from insecure library loading in UPDF.exe. The application resolves and loads FREngine.dll from a directory located under C:\Users\Public\AppData\Local\UPDF\FREngine\Bin64\. This location is writable by standard users on Windows by default, which breaks the trust boundary between the application binaries and user-controlled content.

When a user launches UPDF, the process performs a standard Windows DLL search and binds to whatever FREngine.dll exists at that path. An attacker who drops a malicious DLL with the expected name and exports can hijack the load and execute code inside the UPDF process on the next launch. The condition is classified under CWE-427: Uncontrolled Search Path Element.

The attack requires local access and some user interaction, since UPDF must be launched by the victim after the malicious DLL is planted. The impact affects the confidentiality, integrity, and availability of the local user context.

Root Cause

UPDF does not enforce a trusted load path or signature validation for FREngine.dll. The dependency is resolved from a per-user, world-writable directory rather than a protected location such as %ProgramFiles%\UPDF\ where only administrators can write. Any user or malware running with standard privileges can stage a replacement DLL that satisfies the import table.

Attack Vector

An attacker with local access to the machine drops a crafted FREngine.dll at C:\Users\Public\AppData\Local\UPDF\FREngine\Bin64\FREngine.dll. Because C:\Users\Public is accessible to all interactive users, no privilege escalation is needed to write the file. When the victim next launches UPDF, UPDF.exe loads the attacker-controlled DLL and executes its DllMain or exported functions. The malicious module runs with the privileges of the user launching UPDF and can establish persistence by remaining in place for every subsequent launch.

No verified public proof-of-concept code is available for this issue. Refer to the INCIBE Security Notice for the coordinated advisory details.

Detection Methods for CVE-2025-10215

Indicators of Compromise

• Presence of FREngine.dll in C:\Users\Public\AppData\Local\UPDF\FREngine\Bin64\ that is unsigned or signed by a publisher other than UPDF.
• UPDF.exe loading modules from C:\Users\Public\ paths in Sysmon Event ID 7 (Image Loaded) records.
• Unexpected child processes spawned by UPDF.exe, such as cmd.exe, powershell.exe, or rundll32.exe.

Detection Strategies

• Alert on file-write events targeting C:\Users\Public\AppData\Local\UPDF\FREngine\Bin64\FREngine.dll originating from processes other than the UPDF installer.
• Hunt for module loads by UPDF.exe whose image path resides under any user-writable directory, then verify Authenticode signatures.
• Correlate UPDF launches with subsequent network connections or process creations that deviate from a known-good baseline.

Monitoring Recommendations

• Enable Sysmon Event ID 7 for UPDF.exe and forward the events to a central SIEM for retention and hunting.
• Monitor C:\Users\Public\ recursively for new PE files, especially DLLs with names matching known application dependencies.
• Track process creation events where UPDF.exe is the parent to identify post-exploitation behavior.

How to Mitigate CVE-2025-10215

Immediate Actions Required

• Inventory endpoints running UPDF 1.8.5.0 for Windows and prioritize them for remediation.
• Remove any existing FREngine.dll from C:\Users\Public\AppData\Local\UPDF\FREngine\Bin64\ that was not placed by a legitimate UPDF installation.
• Restrict write permissions on the C:\Users\Public\AppData\Local\UPDF\ directory tree to administrators where operationally feasible.

Patch Information

At the time of publication, no vendor patch link is referenced in the NVD entry. Consult the INCIBE Security Notice and the UPDF vendor for a fixed release. Upgrade to a version later than 1.8.5.0 once the vendor publishes a build that loads FREngine.dll from a protected path or validates its signature.

Workarounds

• Apply an NTFS access control list denying write access to standard users on C:\Users\Public\AppData\Local\UPDF\FREngine\Bin64\.
• Deploy a Windows Defender Application Control (WDAC) or AppLocker DLL rule that blocks unsigned DLLs from loading out of user-writable paths.
• Uninstall UPDF 1.8.5.0 on high-value hosts until a patched version is available.

# Configuration example: restrict write access on the vulnerable directory
icacls "C:\Users\Public\AppData\Local\UPDF\FREngine\Bin64" /inheritance:r
icacls "C:\Users\Public\AppData\Local\UPDF\FREngine\Bin64" /grant:r "BUILTIN\Administrators:(OI)(CI)F" "NT AUTHORITY\SYSTEM:(OI)(CI)F" "BUILTIN\Users:(OI)(CI)RX"