CVE-2025-11178: Acronis True Image DLL Hijacking Vulnerability

CVE-2025-11178 Overview

CVE-2025-11178 is a local privilege escalation vulnerability in multiple Acronis True Image products for Windows. The flaw stems from a DLL hijacking condition (CWE-427: Uncontrolled Search Path Element). An authenticated local attacker can plant a malicious Dynamic Link Library (DLL) that the application loads, gaining elevated privileges on the host. Exploitation requires user interaction and low-privilege access to the target system.

Critical Impact
Successful exploitation grants an attacker the ability to execute arbitrary code with elevated privileges, resulting in full compromise of confidentiality, integrity, and availability on the affected Windows endpoint.

Affected Products

Acronis True Image (Windows) before build 42386
Acronis True Image for Western Digital (Windows) before build 42636
Acronis True Image for SanDisk (Windows) before build 42679
Acronis True Image OEM (Windows) before build 42575

Discovery Timeline

2025-09-30 - CVE-2025-11178 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11178

Vulnerability Analysis

CVE-2025-11178 is a DLL hijacking flaw affecting the Windows builds of Acronis True Image. The application loads one or more DLLs using an uncontrolled search path, allowing Windows to resolve the library from a directory writable by a lower-privileged user. When a privileged process subsequently loads the attacker-controlled DLL, the code executes in the security context of that process.

Because Acronis True Image performs backup and system-level operations, its components run with elevated privileges. Loading a malicious library therefore transitions execution from a standard user context to a privileged one, satisfying the local privilege escalation impact described in the vendor advisory.

Root Cause

The root cause is improper handling of the DLL search order, categorized under CWE-427. The application references dependent libraries without fully qualified paths or without enforcing a safe search order using APIs such as SetDefaultDllDirectories or LoadLibraryEx with LOAD_LIBRARY_SEARCH_SYSTEM32. This lets Windows resolve the DLL from directories that a local, non-administrative user can write to.

Attack Vector

The attack vector is local and requires user interaction. An attacker with low-privilege access places a crafted DLL in a directory that appears earlier in the DLL search order than the legitimate library. When a user launches Acronis True Image or triggers a component that loads the affected DLL, the malicious library executes with the privileges of the host process. Refer to the Acronis Security Advisory SEC-7078 for vendor-supplied technical details.

Detection Methods for CVE-2025-11178

Indicators of Compromise

Unsigned or unexpected DLL files present in Acronis True Image installation or working directories.
New DLLs written to user-writable directories that share names with legitimate Acronis dependencies.
Acronis True Image processes loading modules from non-standard paths such as user profile folders or temporary directories.
Child processes spawned by Acronis True Image executables that perform activity unrelated to backup operations.

Detection Strategies

Monitor image load events (Sysmon Event ID 7) for Acronis True Image processes loading DLLs from unexpected paths.
Track file creation events (Sysmon Event ID 11) for DLL writes in directories adjacent to Acronis binaries.
Alert on privilege escalation patterns where a low-integrity user process precedes elevated code execution originating from an Acronis component.

Monitoring Recommendations

Enable application allowlisting to restrict which DLLs can load from user-writable locations.
Baseline the expected DLL load paths for Acronis True Image processes and alert on deviations.
Correlate endpoint telemetry for backup application activity with file-write events targeting known Acronis directories.

How to Mitigate CVE-2025-11178

Immediate Actions Required

Upgrade Acronis True Image (Windows) to build 42386 or later.
Upgrade Acronis True Image for Western Digital to build 42636 or later.
Upgrade Acronis True Image for SanDisk to build 42679 or later.
Upgrade Acronis True Image OEM to build 42575 or later.
Audit endpoints for unauthorized DLLs in Acronis installation directories and user-writable paths.

Patch Information

Acronis has published fixed builds for each affected product line. Administrators should consult the Acronis Security Advisory SEC-7078 for the authoritative list of patched builds and download links, then deploy the updates across all Windows endpoints running affected versions.

Workarounds

Restrict write permissions on directories included in the DLL search path for Acronis True Image processes.
Enforce standard user separation so that only trusted administrators can modify application directories.
Deploy Windows Defender Application Control (WDAC) or AppLocker rules that block execution of unsigned DLLs from user-writable locations.
Remove Acronis True Image from systems where updates cannot be applied promptly.

bash

# Configuration example
# Enumerate DLLs in the Acronis True Image installation path and flag unsigned modules
Get-ChildItem -Path "C:\Program Files (x86)\Acronis\TrueImageHome" -Recurse -Filter *.dll |
  ForEach-Object {
    $sig = Get-AuthenticodeSignature $_.FullName
    if ($sig.Status -ne 'Valid') {
      Write-Output "Unsigned or invalid DLL: $($_.FullName)"
    }
  }