CVE-2025-10213
📋 TL;DR
This DLL search path hijacking vulnerability in UPDF.exe allows attackers with local access to execute arbitrary code by placing a malicious dxtn.dll file in a specific Windows directory. The vulnerability affects Windows users running UPDF version 1.8.5.0, potentially leading to system compromise and persistence.
💻 Affected Systems
- UPDF
📦 What is this software?
Updf by Updf
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining persistence, data exfiltration, and lateral movement capabilities.
Likely Case
Local privilege escalation leading to unauthorized access to sensitive files and system resources.
If Mitigated
Limited impact with proper file permissions and application whitelisting preventing DLL execution.
🎯 Exploit Status
Exploitation requires local access and ability to place DLL in specific directory. Simple DLL hijacking technique.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-updf
Restart Required: No
Instructions:
Check vendor website for updated version. Uninstall vulnerable version and install patched version when available.
🔧 Temporary Workarounds
Restrict write permissions to WindowsApps directory
windowsRemove write permissions for non-administrative users to the vulnerable directory
icacls "C:\Users\%USERNAME%\AppData\Local\Microsoft\WindowsApps" /deny Users:(OI)(CI)W
Remove vulnerable UPDF version
windowsUninstall UPDF version 1.8.5.0 until patched version is available
appwiz.cpl
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of unauthorized DLLs
- Monitor for DLL files being created in C:\Users\*\AppData\Local\Microsoft\WindowsApps\ directory
🔍 How to Verify
Check if Vulnerable:
Check UPDF version in About dialog or via Control Panel > Programs and Features. Version 1.8.5.0 is vulnerable.Check Version:
wmic product where name="UPDF" get versionVerify Fix Applied:
Verify UPDF version is updated beyond 1.8.5.0. Check vendor advisory for specific patched version.📡 Detection & Monitoring
Log Indicators:
- File creation events for dxtn.dll in WindowsApps directory
- Process creation events for UPDF.exe loading unexpected DLLs
Network Indicators:
- Unusual outbound connections from UPDF.exe process
SIEM Query:
source="windows" AND (event_id=11 AND file_path="*WindowsApps*dxtn.dll") OR (event_id=4688 AND process_name="UPDF.exe")