CVE-2025-13919: Symantec Endpoint Protection COM Hijack

CVE-2025-13919 Overview

CVE-2025-13919 is a COM Hijacking vulnerability affecting Symantec Endpoint Protection. This vulnerability allows an attacker to establish persistence and evade detection by hijacking COM (Component Object Model) references in the Windows Registry. COM Hijacking is a well-known persistence technique that exploits the way Windows applications locate and load COM objects, enabling attackers to execute malicious code whenever a legitimate application attempts to instantiate a hijacked COM object.

Critical Impact

Attackers can achieve persistent access and evade security detection by manipulating Windows Registry COM references, potentially compromising enterprise endpoint security infrastructure.

Affected Products

• Symantec Endpoint Protection prior to 14.3 RU10 Patch 1
• Symantec Endpoint Protection prior to 14.3 RU9 Patch 2
• Symantec Endpoint Protection prior to 14.3 RU8 Patch 3

Discovery Timeline

• 2026-01-28 - CVE-2025-13919 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2025-13919

Vulnerability Analysis

This COM Hijacking vulnerability (CWE-427: Uncontrolled Search Path Element) affects Symantec Endpoint Protection's handling of COM object references. The vulnerability stems from improper validation of COM object paths in the Windows Registry, allowing an attacker with low privileges to redirect legitimate COM object instantiation to malicious payloads.

The attack requires network access with low privileges and no user interaction, making it suitable for post-exploitation scenarios where an attacker has already gained initial access to a system. The vulnerability impacts both confidentiality and integrity of the affected system, as attackers can intercept data and modify system behavior through the hijacked COM objects.

Root Cause

The root cause of this vulnerability lies in the search path mechanism used by Symantec Endpoint Protection when loading COM components. Windows applications typically search for COM objects in a specific order through the Registry, and if the application does not properly validate the source of COM DLLs, an attacker can insert malicious Registry entries that point to attacker-controlled code.

The vulnerability is classified under CWE-427 (Uncontrolled Search Path Element), indicating that the application fails to properly control the search path used to locate resources such as DLLs or COM objects, allowing attackers to plant malicious components in locations that are searched before legitimate ones.

Attack Vector

The attack vector for CVE-2025-13919 involves manipulating Windows Registry keys associated with COM objects used by Symantec Endpoint Protection. An attacker with low-level access to the system can:

1. Identify COM objects referenced by Symantec Endpoint Protection
2. Create or modify Registry entries under HKEY_CURRENT_USER\Software\Classes\CLSID or similar locations
3. Point these entries to malicious DLLs under the attacker's control
4. Wait for the legitimate application to load the hijacked COM object

Because HKEY_CURRENT_USER is searched before HKEY_LOCAL_MACHINE in the COM resolution process, a low-privileged user can establish persistence that executes within the context of the security application. This technique is particularly concerning as it targets endpoint protection software, potentially allowing attackers to subvert security controls.

The vulnerability does not require user interaction and can be exploited remotely once initial access is achieved, making it valuable for maintaining persistent access to compromised systems.

Detection Methods for CVE-2025-13919

Indicators of Compromise

• Unexpected Registry modifications under HKEY_CURRENT_USER\Software\Classes\CLSID or HKEY_LOCAL_MACHINE\Software\Classes\CLSID pointing to non-standard DLL paths
• Unusual DLL files in user-writable directories that are loaded by Symantec Endpoint Protection processes
• Registry entries with COM CLSIDs that reference executable content outside of standard Symantec installation directories
• Process anomalies where Symantec services load DLLs from unexpected locations

Detection Strategies

• Monitor Registry changes to COM-related keys, particularly those under HKEY_CURRENT_USER\Software\Classes\CLSID
• Implement DLL load monitoring for Symantec Endpoint Protection processes to detect loading from non-standard paths
• Use behavioral detection to identify COM hijacking patterns, including creation of new CLSID entries followed by DLL loads
• Deploy endpoint detection rules that alert on modifications to Registry keys associated with known Symantec COM objects

Monitoring Recommendations

• Enable detailed Registry auditing on Windows endpoints, focusing on COM-related Registry paths
• Configure SIEM rules to correlate Registry modifications with subsequent process behavior anomalies
• Implement file integrity monitoring on directories commonly used for COM hijacking attacks
• Review Symantec Endpoint Protection logs for unusual component loading patterns

How to Mitigate CVE-2025-13919

Immediate Actions Required

• Update Symantec Endpoint Protection to version 14.3 RU10 Patch 1, RU9 Patch 2, or RU8 Patch 3 depending on your current release
• Audit Windows Registry for unauthorized COM object references related to Symantec components
• Review user permissions to restrict ability to modify COM-related Registry keys
• Implement application whitelisting to prevent execution of unauthorized DLLs

Patch Information

Broadcom has released security patches addressing this vulnerability. Organizations should apply the appropriate patch based on their current Symantec Endpoint Protection version:

• For 14.3 RU10: Apply Patch 1
• For 14.3 RU9: Apply Patch 2
• For 14.3 RU8: Apply Patch 3

Refer to Broadcom Security Advisory #36774 for detailed patching instructions and download links.

Workarounds

• Restrict user write access to COM-related Registry keys using Group Policy or Registry permissions
• Implement strict application control policies to prevent execution of unsigned or unauthorized DLLs
• Monitor and alert on any changes to Registry paths under HKEY_CURRENT_USER\Software\Classes\CLSID
• Consider deploying additional endpoint detection capabilities focused on COM hijacking techniques until patches can be applied