CVE-2025-32780: BleachBit DLL Hijacking RCE Vulnerability

CVE-2025-32780 Overview

CVE-2025-32780 is a DLL hijacking vulnerability affecting BleachBit for Windows up to version 4.6.2. BleachBit is a disk cleaning and privacy tool that removes cached files, cookies, and temporary data. The vulnerability allows an attacker to plant a malicious uuid.dll file in C:\Users\<username>\AppData\Local\Microsoft\WindowsApps\, which BleachBit loads at runtime. Each execution of BleachBit triggers loading of the attacker-controlled library, resulting in arbitrary code execution in the context of the user. The issue is tracked as [CWE-427: Uncontrolled Search Path Element] and was patched in version 4.9.0.

Critical Impact

Arbitrary code execution occurs every time BleachBit runs, providing attackers with a reliable persistence and privilege inheritance mechanism on Windows endpoints.

Affected Products

• BleachBit for Windows versions up to and including 4.6.2
• BleachBit for Windows deployments on user-writable Windows profiles
• Fixed in BleachBit version 4.9.0

Discovery Timeline

• 2025-04-15 - CVE-2025-32780 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32780

Vulnerability Analysis

BleachBit for Windows loads uuid.dll at startup using the default Windows DLL search order. The application does not pin the library to a trusted absolute path or validate its signature before loading. Because C:\Users\<username>\AppData\Local\Microsoft\WindowsApps\ appears in the user PATH environment variable on modern Windows installations, and is writable by the current user, an attacker with low-privilege local access can drop a malicious DLL there. Windows resolves the DLL from this directory before falling back to system locations, causing the hijack.

The attacker payload runs inside the BleachBit process. When a user or scheduled task launches BleachBit with elevated privileges, the injected code inherits those rights. This provides a straightforward path from unprivileged code execution to persistence and privilege escalation.

Root Cause

The root cause is an insecure DLL search path in the packaged Windows build. The setup_py2exe.py build script relied on sys.prefix alone to bundle required DLLs. When uuid.dll was not present there, it was silently omitted from the distribution, forcing the runtime to search the user PATH and pick up an attacker-planted copy.

Attack Vector

Exploitation requires local access with standard user privileges and user interaction to run BleachBit. An attacker writes uuid.dll to %LOCALAPPDATA%\Microsoft\WindowsApps\ and waits for BleachBit execution to trigger DLL loading.

     else:
         logger.error('Unsupported Python version. Skipping DLL copy.')
         return
-    dll_path = os.path.join(sys.prefix, dll_name)
-    if os.path.exists(dll_path):
-        shutil.copy(dll_path, 'dist')
-    else:
+    dll_dirs = (sys.prefix, r'c:\windows\system32', r'c:\windows\SysWOW64')
+    copied_dll = False
+    for dll_dir in dll_dirs:
+        dll_path = os.path.join(dll_dir, dll_name)
+        if os.path.exists(dll_path):
+            logger.info(f'Copying {dll_name} from {dll_path}')
+            shutil.copy(dll_path, 'dist')
+            copied_dll = True
+            break
+    if not copied_dll:
         logger.warning(f'{dll_name} not found. Skipping copy.')
 
     sign_files(('dist\\bleachbit.exe', 'dist\\bleachbit_console.exe'))

Source: BleachBit Commit dafeba57. The patch expands the DLL source search to include c:\windows\system32 and c:\windows\SysWOW64, ensuring uuid.dll ships inside the trusted installation directory.

Detection Methods for CVE-2025-32780

Indicators of Compromise

• Presence of uuid.dll inside %LOCALAPPDATA%\Microsoft\WindowsApps\ on systems that have BleachBit installed.
• Unsigned or unexpected DLL modules loaded by bleachbit.exe or bleachbit_console.exe.
• File write events to WindowsApps originating from non-Microsoft processes.

Detection Strategies

• Monitor process image loads for bleachbit.exe and alert when uuid.dll is loaded from a user-writable directory instead of the BleachBit install path.
• Correlate file-creation events for uuid.dll in per-user directories with subsequent BleachBit executions.
• Inventory endpoints running BleachBit versions prior to 4.9.0 through software asset management tooling.

Monitoring Recommendations

• Enable Windows Sysmon Event ID 7 (Image Loaded) with signature validation to catch unsigned DLL loads in BleachBit processes.
• Track integrity levels of processes spawned from BleachBit to detect privilege inheritance from scheduled or elevated launches.
• Baseline the contents of %LOCALAPPDATA%\Microsoft\WindowsApps\ and alert on new DLL files.

How to Mitigate CVE-2025-32780

Immediate Actions Required

• Upgrade BleachBit for Windows to version 4.9.0 or later on all endpoints.
• Audit %LOCALAPPDATA%\Microsoft\WindowsApps\ on managed systems for the presence of uuid.dll and remove untrusted copies.
• Restrict local user ability to run BleachBit from elevated contexts until patching is complete.

Patch Information

The vendor patch is delivered in BleachBit 4.9.0. The fix, committed in commit dafeba57, updates windows/setup_py2exe.py so the installer copies uuid.dll from trusted system directories such as c:\windows\system32 and c:\windows\SysWOW64 into the BleachBit install folder. This ensures the DLL is present locally and preempts Windows search-order resolution to user-writable paths. Additional context is available in the BleachBit Security Advisory GHSA-ghph-v4x4-vr3c.

Workarounds

• Remove %LOCALAPPDATA%\Microsoft\WindowsApps\ from the user PATH where App Execution Aliases are not required.
• Apply an AppLocker or Windows Defender Application Control (WDAC) rule that blocks unsigned DLL loads from user-writable directories.
• Restrict write permissions on the WindowsApps alias directory through Group Policy where feasible.

# Verify installed BleachBit version and inspect the WindowsApps directory
powershell -Command "(Get-Item 'C:\Program Files (x86)\BleachBit\bleachbit.exe').VersionInfo.ProductVersion"
powershell -Command "Get-ChildItem $env:LOCALAPPDATA\Microsoft\WindowsApps -Filter uuid.dll -ErrorAction SilentlyContinue"