CVE-2025-64772 Overview
CVE-2025-64772 is a high-severity DLL search path vulnerability affecting the Sony INZONE Hub installer. The installer for INZONE Hub versions 1.0.10.3 through 1.0.17.0 contains an insecure DLL search path issue (CWE-427), which may lead to insecurely loading Dynamic Link Libraries. This vulnerability allows an attacker to execute arbitrary code with the privilege of the user invoking the installer.
Critical Impact
Attackers can achieve arbitrary code execution by placing a malicious DLL in a location searched by the vulnerable installer, potentially gaining full control of the affected system with the privileges of the user running the installation.
Affected Products
- Sony INZONE Hub 1.0.10.3
- Sony INZONE Hub versions through 1.0.17.0
- Windows systems running the vulnerable INZONE Hub installer
Discovery Timeline
- 2025-12-01 - CVE-2025-64772 published to NVD
- 2025-12-01 - Last updated in NVD database
Technical Details for CVE-2025-64772
Vulnerability Analysis
This vulnerability is classified as CWE-427 (Uncontrolled Search Path Element), which occurs when an application searches for critical resources such as DLL files in locations that are under the control of potential attackers. The Sony INZONE Hub installer versions 1.0.10.3 through 1.0.17.0 do not properly control the search path used to locate Dynamic Link Libraries during the installation process.
The vulnerability carries a CVSS 4.0 score of 8.4 (HIGH) with the following vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. This indicates a local attack vector with low complexity, no privileges required, but user interaction is needed. The impact on confidentiality, integrity, and availability is rated as high.
The EPSS (Exploit Prediction Scoring System) data shows a probability of 0.015% at the 2.14th percentile, indicating a relatively low likelihood of exploitation in the wild at this time.
Root Cause
The root cause of this vulnerability lies in the insecure DLL loading mechanism employed by the INZONE Hub installer. When the installer executes, it searches for required DLL files in multiple locations according to the Windows DLL search order. If the installer does not specify absolute paths for DLL loading or does not implement proper security controls, it may load a malicious DLL from an attacker-controlled directory before locating the legitimate system DLL.
Common locations exploited in DLL search path attacks include:
- The directory from which the application is loaded (e.g., the Downloads folder)
- The current working directory
- User-writable directories in the system PATH
Attack Vector
The attack requires local access to the target system and involves the following scenario:
An attacker places a specially crafted malicious DLL with a name matching one of the DLLs that the INZONE Hub installer attempts to load into a directory that is searched before the legitimate DLL location. When an unsuspecting user downloads and executes the INZONE Hub installer, the malicious DLL is loaded instead of the legitimate one, resulting in arbitrary code execution with the user's privileges.
This attack is particularly effective when users download installers to common locations like the Downloads folder and execute them directly from there. An attacker who can place files in the same directory (through social engineering, another vulnerability, or local access) can exploit this condition.
Detection Methods for CVE-2025-64772
Indicators of Compromise
- Unexpected DLL files present in the same directory as the INZONE Hub installer executable
- Suspicious DLL files in user-writable directories with names matching common Windows system DLLs
- Process execution anomalies during INZONE Hub installation with unexpected child processes or network connections
Detection Strategies
Organizations should implement monitoring for DLL side-loading attacks, particularly during software installation processes. Key detection strategies include:
Process Monitoring: Monitor for instances of the INZONE Hub installer loading DLLs from unexpected locations, particularly user-writable directories such as Downloads, Desktop, or temporary folders.
File Integrity Monitoring: Implement monitoring for new DLL files appearing in common download locations or directories containing installer executables.
Behavioral Analysis: SentinelOne's Singularity platform provides behavioral AI detection that can identify suspicious DLL loading patterns and block malicious code execution attempts during software installation.
Monitoring Recommendations
Security teams should configure endpoint detection solutions to alert on:
- DLL loads from user-writable directories during installer execution
- Unsigned or unusually signed DLLs loaded by trusted installer executables
- Process hollowing or injection techniques that may follow initial DLL hijacking
SentinelOne customers benefit from automated detection and response capabilities that can identify and remediate DLL hijacking attempts in real-time without requiring signature updates.
How to Mitigate CVE-2025-64772
Immediate Actions Required
- Update Sony INZONE Hub to the latest version available from the official Sony support page
- Avoid running installers directly from the Downloads folder; instead, move them to a dedicated, clean directory
- Verify the integrity of installer files using checksums provided by Sony before execution
Patch Information
Sony has acknowledged this vulnerability and provides updated software through their official support channel. Users should download the latest version of INZONE Hub from the official Sony Electronics support page at https://www.sony.com/electronics/support/others-software/inzone-hub.
Additional vulnerability details and remediation guidance are available through the Japan Vulnerability Notes (JVN) advisory at https://jvn.jp/en/jp/JVN28247549/.
Workarounds
If immediate patching is not possible, the following workarounds can reduce risk:
Create a dedicated installation directory: Before running the INZONE Hub installer, create a new folder with restricted permissions and copy only the installer executable to this location.
Run installers with reduced privileges: Where possible, avoid running installers with administrative privileges unless absolutely necessary.
Clear the download directory: Ensure no unexpected DLL files are present in the directory containing the installer before execution.
Enable Windows Defender Application Control (WDAC): Implement application control policies to prevent execution of unsigned or untrusted DLLs.
Organizations should prioritize updating to a patched version of INZONE Hub as the primary remediation strategy.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
