CVE-2025-4455: Patch My PC Home Updater Path Traversal

CVE-2025-4455 Overview

CVE-2025-4455 is an uncontrolled search path vulnerability [CWE-426] affecting Patch My PC Home Updater versions up to 5.1.3.0. The flaw resides in how the application resolves numerous Windows system libraries, including advapi32.dll, BCrypt.dll, comctl32.dll, crypt32.dll, kernel32.dll, ntdll.dll, ole32.dll, shell32.dll, and related dependencies. A local attacker who can place a malicious DLL in a location searched before the legitimate system directory can achieve arbitrary code execution in the context of the updater process. The vendor was contacted but did not respond, and the exploit details are public.

Critical Impact
Local attackers can load attacker-controlled DLLs into the Patch My PC Home Updater process, resulting in code execution with the privileges of the running user.

Affected Products

Patch My PC Home Updater versions up to and including 5.1.3.0
Windows hosts running the vulnerable updater binary
Environments where standard users can write to directories referenced in the DLL search order

Discovery Timeline

2025-05-09 - CVE-2025-4455 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-4455

Vulnerability Analysis

The vulnerability is a classic uncontrolled search path element issue affecting a large set of dynamically loaded libraries used by Patch My PC Home Updater. When the application starts, it resolves imports for libraries such as advapi32.dll, crypt32.dll, gdi32.dll, iphlpapi.dll, msctf.dll, ntdll.dll, secur32.dll, shcore.dll, and PresentationNative_cor3.dll using the default Windows DLL search order.

If any directory earlier in the search order than System32 contains an attacker-supplied DLL with a matching name, the loader maps and executes the malicious library. Because the updater typically runs with the invoking user's rights, and can be launched from installers or task-driven contexts, the executed payload inherits those privileges.

Exploitation is rated as high complexity because the attacker must control a directory in the effective search path and predict the load sequence. However, the payload is publicly available, lowering the barrier for practical abuse.

Root Cause

The root cause is failure to specify fully qualified paths or to call SetDefaultDllDirectories with LOAD_LIBRARY_SEARCH_SYSTEM32 before resolving imports. Without these safeguards, the Windows loader consults the application directory, current working directory, and PATH entries, any of which may be writable by a lower-privileged user.

Attack Vector

An attacker with local access places a crafted DLL that matches one of the vulnerable library names in a directory that precedes System32 in the search order. When a user launches Patch My PC Home Updater from that location, or via a shortcut whose working directory is attacker-controlled, the malicious DLL is loaded and its DllMain executes. This grants the attacker arbitrary code execution in the updater's process, and can be chained with social engineering to broaden impact.

A public payload sample is referenced from a GitHub Gist proof of concept. See the VulDB entry #308069 for additional technical context.

Detection Methods for CVE-2025-4455

Indicators of Compromise

Presence of DLL files matching Windows system library names (for example crypt32.dll, ole32.dll, secur32.dll) in the Patch My PC Home Updater installation folder or any user-writable working directory.
Unsigned or unexpectedly signed copies of core Windows DLLs sitting outside C:\Windows\System32.
Unusual child processes spawned by the Patch My PC updater executable shortly after launch.

Detection Strategies

Monitor image load events (Sysmon Event ID 7) for the updater process loading DLLs from paths other than C:\Windows\System32 or the application's signed install directory.
Alert on file creation events where any of the listed library names are written to non-system directories by non-privileged users.
Correlate updater executions with subsequent anomalous network connections or credential-access behavior.

Monitoring Recommendations

Enable Sysmon with a configuration that captures ImageLoad events for known LOLBins and updater utilities.
Baseline expected DLL load paths for administrative tooling and flag deviations.
Track user-writable directories on PATH for the creation of executables and libraries.

How to Mitigate CVE-2025-4455

Immediate Actions Required

Inventory endpoints for Patch My PC Home Updater installations at or below version 5.1.3.0.
Restrict execution of the updater from user-writable directories using application control policies such as Windows Defender Application Control or AppLocker.
Remove any unauthorized DLLs with system library names from user-writable paths.

Patch Information

The vendor did not respond to disclosure attempts, and no fixed version is referenced in the advisory. Monitor the Patch My PC vendor site for updates beyond 5.1.3.0 that address the DLL search path handling, and validate any release against the behaviors described above.

Workarounds

Launch the updater only from its signed installation directory and avoid running it from download folders, network shares, or removable media.
Configure Windows to enforce safe DLL search mode by setting HKLM\System\CurrentControlSet\Control\Session Manager\SafeDllSearchMode to 1.
Remove writable entries from the system and user PATH variables that precede System32.
Restrict use of the Home edition on managed endpoints and prefer the enterprise product where DLL load behavior can be centrally reviewed.

bash

# Enable Safe DLL Search Mode via PowerShell (run as Administrator)
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Session Manager" `
  -Name "SafeDllSearchMode" -Value 1 -Type DWord

# Audit for suspicious DLLs alongside the updater binary
Get-ChildItem -Path "C:\Users\*\AppData\*\PatchMyPC*" -Recurse -Include *.dll |
  Where-Object { $_.Name -in @('crypt32.dll','ole32.dll','secur32.dll','ntdll.dll','shell32.dll') }