CVE-2025-10214

7.0 highEPSS 0.2%

High (7.0) in updf updf. EPSS 0.2% chance of exploitation in the next 30 days.

DLL search path hijacking vulnerability in the UPDF.exe executable for Windows version 1.8.5.0 allows attackers with local access to execute arbitrary code by placing a FREngine.dll file of their choice in the 'C:\Users\<user>\AppData\Local\UPDF\FREngine\Bin64\' directory, which could lead to arbitrary code execution and persistence.

Severity

CVSS 4.0

7.0 high

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

7.8 high

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 6% of CVEs (scores of 2026-10-31)
CWE: CWE-427
Published: 2025-09-10
Modified: 2026-09-26
Record from: the NVD, synced 2026-10-19

Affected

updf:updf

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-updf

Check your stack JSON