CVE-2025-49154: Trendmicro Worry-free Business Security Escalation

CVE-2025-49154 Overview

CVE-2025-49154 is an insecure access control vulnerability [CWE-284] affecting Trend Micro Apex One and Trend Micro Worry-Free Business Security. A local attacker with the ability to execute low-privileged code on a Windows host can overwrite key memory-mapped files used by the security product. Overwriting these files disrupts the security and stability of the affected installation and can enable privilege escalation on the host. Trend Micro has published vendor advisories KA-0019917 and KA-0019936 describing fixed builds.

Critical Impact
A local, low-privileged attacker can overwrite protected memory-mapped files belonging to the Trend Micro agent, leading to high-impact compromise of confidentiality, integrity, and availability on affected Windows endpoints.

Affected Products

Trend Micro Apex One (on-premises and SaaS, Windows)
Trend Micro Worry-Free Business Security 10.0 SP1 (Standard and Advanced)
Trend Micro Worry-Free Business Security Services (SaaS)

Discovery Timeline

2025-06-17 - CVE-2025-49154 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-49154

Vulnerability Analysis

The flaw stems from improper access control on memory-mapped files (also known as file-backed sections) that the Trend Micro agent creates on Windows. These sections back configuration, state, or executable data that the privileged agent process reads at runtime. Because the underlying section object or file is created with permissive access rights, a standard user process can open a writable handle to it. Writing crafted data into a section that a higher-privileged component subsequently maps and trusts yields code execution or logic corruption in that component's context. The result is local privilege escalation and tampering with endpoint protection state.

Root Cause

The root cause is a missing or overly permissive discretionary access control list (DACL) on the memory-mapped objects and their backing files. Trend Micro classifies the issue under [CWE-284] Improper Access Control. The agent trusts data read from these sections without validating integrity or restricting write access to SYSTEM and administrator security principals.

Attack Vector

Exploitation requires local, authenticated access to the target Windows system with low privileges. No user interaction is required. The attacker enumerates the shared section objects or backing files owned by the Trend Micro agent, opens them for write access, and injects controlled content. When the privileged Trend Micro service consumes the tampered data, the attacker gains code execution or disables the security agent. No public proof-of-concept or in-the-wild exploitation has been reported at time of writing.

No verified public exploit code exists for CVE-2025-49154. See the Trend Micro advisories linked in the Patch Information section for vendor-provided technical context.

Detection Methods for CVE-2025-49154

Indicators of Compromise

Unexpected write handles opened to Trend Micro agent files or named section objects by non-SYSTEM, non-administrator processes.
Trend Micro service crashes, unexpected restarts, or tamper-protection alerts on Apex One or Worry-Free endpoints.
Modification timestamps on Trend Micro agent binaries or state files under Program Files\Trend Micro\ that do not correlate with vendor updates.

Detection Strategies

Monitor for CreateFileMapping, OpenFileMapping, and MapViewOfFile activity targeting Trend Micro named objects from non-privileged processes.
Hunt for file write events on Trend Micro installation directories originating from user-context processes rather than the vendor updater service.
Correlate local privilege escalation patterns, such as a low-privilege process spawning a SYSTEM-context child, with prior tampering of security product files.

Monitoring Recommendations

Enable Windows object access auditing on the Trend Micro program directory and alert on writes from unexpected principals.
Forward Trend Micro tamper-protection and self-protection events to your SIEM for correlation with endpoint telemetry.
Track version and build numbers of installed Apex One and Worry-Free agents against the fixed builds listed in KA-0019917 and KA-0019936.

How to Mitigate CVE-2025-49154

Immediate Actions Required

Apply the fixed builds referenced in the Trend Micro Solution KA-0019917 and Trend Micro Solution KA-0019936 advisories on all Apex One and Worry-Free endpoints.
Restrict interactive and remote low-privilege access on servers running the Trend Micro management or agent components until patches are deployed.
Verify that Trend Micro self-protection and tamper-protection features are enabled on all managed endpoints.

Patch Information

Trend Micro has released updated builds for Apex One (on-premises and SaaS) and Worry-Free Business Security. Consult Trend Micro Solution KA-0019917 for Apex One and Trend Micro Solution KA-0019936 for Worry-Free Business Security to identify the required build and deployment steps for your environment.

Workarounds

No official workaround eliminates the vulnerability; patching is required.
Reduce the local attack surface by enforcing least privilege and blocking untrusted binary execution on endpoints running the affected agents.
Apply application control policies to prevent unauthorized processes from interacting with Trend Micro agent files and objects.

bash

# Verify installed Trend Micro Apex One agent version on Windows
reg query "HKLM\SOFTWARE\WOW6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion" /v ProgramVer

# Confirm the Trend Micro service is running and self-protection is active
sc query "TmListen"
sc query "TMBMServer"