CVE-2025-49384: Trend Micro Security Privilege Escalation

CVE-2025-49384 Overview

CVE-2025-49384 affects Trend Micro Security 17.8 (Consumer) on Windows. The vulnerability is a link following flaw that enables local privilege escalation through file system manipulation [CWE-64]. A local attacker with low privileges can abuse symbolic or hard link handling to cause the security product to delete privileged Trend Micro files, including its own protected components. Successful exploitation degrades the integrity and availability of the endpoint protection software. The issue requires local access and low-level user privileges but no user interaction.

Critical Impact
Local attackers can leverage link following to force Trend Micro Security into deleting privileged files, undermining endpoint protection integrity.

Affected Products

Trend Micro Maximum Security 2022, version 17.8 (Consumer)
Microsoft Windows (all supported host versions running the affected product)
Trend Micro Security 17.8 Consumer product family

Discovery Timeline

2025-06-17 - CVE-2025-49384 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49384

Vulnerability Analysis

The vulnerability resides in how Trend Micro Security 17.8 handles file operations on paths that may resolve through symbolic links, junctions, or hard links. When a privileged service component performs a delete or cleanup action on a target file, it does not sufficiently verify that the path resolves to a legitimate, non-redirected location. A local attacker who can create link objects at attacker-controllable paths can redirect these operations to files the attacker cannot normally modify.

The result is a local privilege escalation primitive built on arbitrary file deletion. An attacker can force the product to remove Trend Micro binaries, configuration data, or other protected files on the system. Removing these files can disable protection, break integrity assumptions, or serve as a stepping stone for further privilege escalation on Windows.

Root Cause

The root cause is unsafe path resolution during privileged file operations, classified under [CWE-64] Windows Shortcut Following (.LNK) and link-following weaknesses. The service does not validate the final resolved target against the intended target before executing a destructive operation.

Attack Vector

Exploitation requires local access with low privileges on the Windows host. The attacker plants a link at a path that the privileged Trend Micro process later operates on, causing that operation to follow the link and act on an unintended file. No user interaction is required. Technical details are described in the Trend Micro Security Advisory TMKA-11112.

Detection Methods for CVE-2025-49384

Indicators of Compromise

Unexpected deletion of files under Trend Micro installation directories such as C:\Program Files\Trend Micro\ or C:\ProgramData\Trend Micro\.
Creation of NTFS junctions, symbolic links, or hard links by low-privileged users pointing into privileged directories.
Trend Micro service faults, missing modules, or self-protection alerts immediately following link creation events.

Detection Strategies

Monitor Windows Sysmon Event ID 11 (FileCreate) and Event ID 23 (FileDelete) for Trend Micro paths accessed by non-SYSTEM contexts.
Alert on CreateSymbolicLink, mklink, or reparse point creation from user-writable directories such as %TEMP% or %LOCALAPPDATA%.
Correlate link creation by a standard user with a subsequent privileged delete of a Trend Micro file within a short time window.

Monitoring Recommendations

Enable file integrity monitoring on Trend Micro program and data directories to flag unauthorized deletions.
Audit reparse point and junction activity in user-writable paths using Windows Security auditing or EDR telemetry.
Track Trend Micro service health and self-protection state changes as a signal of tampering.

How to Mitigate CVE-2025-49384

Immediate Actions Required

Apply the fixed build of Trend Micro Security 17.8 (Consumer) as directed in TMKA-11112.
Restrict interactive local logon on affected endpoints to trusted users only.
Verify Trend Micro self-protection is enabled and reporting a healthy state on every managed host.

Patch Information

Trend Micro has published guidance and fixed builds in the Trend Micro Security Advisory (TMKA-11112). Consumer users should install the latest Trend Micro Security 17.8 update through the product's built-in update mechanism.

Workarounds

Remove the SeCreateSymbolicLinkPrivilege from standard user accounts via Group Policy where feasible.
Limit local logon to administrative users on multi-user Windows systems until patching is complete.
Monitor and alert on any junction, symlink, or hard link creation that references Trend Micro directories.

bash

# Verify and restrict symbolic link privilege on Windows
whoami /priv | findstr SeCreateSymbolicLinkPrivilege

# Group Policy path to restrict link creation:
# Computer Configuration > Windows Settings > Security Settings >
#   Local Policies > User Rights Assignment > Create symbolic links
# Remove standard users and keep only Administrators.

# Confirm Trend Micro Security build after update
reg query "HKLM\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion" /v ProgramVer