CVE-2025-10215
📋 TL;DR
This DLL search path hijacking vulnerability in UPDF for Windows allows attackers with local access to execute arbitrary code by placing a malicious FREngine.dll file in a specific directory. This affects users running UPDF version 1.8.5.0 on Windows systems where attackers can write to the vulnerable directory.
💻 Affected Systems
- UPDF
📦 What is this software?
Updf by Updf
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with persistent backdoor installation, data theft, and lateral movement across the network.
Likely Case
Local privilege escalation leading to unauthorized access to sensitive files and system resources.
If Mitigated
Limited impact with proper file permissions and user access controls preventing DLL placement.
🎯 Exploit Status
Exploitation requires local access and ability to write to the specific directory. No authentication bypass needed beyond local system access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-updf
Restart Required: No
Instructions:
Check vendor website for updated version. If available, download and install the patched version of UPDF.
🔧 Temporary Workarounds
Restrict directory permissions
windowsSet restrictive permissions on the vulnerable directory to prevent unauthorized writes
icacls "C:\Users\Public\AppData\Local\UPDF\FREngine\Bin64" /deny Everyone:(OI)(CI)F
Remove vulnerable directory
windowsDelete or rename the vulnerable directory to prevent DLL placement
rmdir /s /q "C:\Users\Public\AppData\Local\UPDF\FREngine\Bin64"
🧯 If You Can't Patch
- Implement strict file system permissions to prevent unauthorized writes to the vulnerable directory
- Monitor for suspicious DLL files in the vulnerable directory using file integrity monitoring
🔍 How to Verify
Check if Vulnerable:
Check if directory 'C:\Users\Public\AppData\Local\UPDF\FREngine\Bin64' exists and is writable by non-admin usersCheck Version:
Check UPDF version in Help > About or via file properties of UPDF.exeVerify Fix Applied:
Verify directory permissions prevent unauthorized writes or directory no longer exists📡 Detection & Monitoring
Log Indicators:
- File creation events in 'C:\Users\Public\AppData\Local\UPDF\FREngine\Bin64' directory
- Process creation from UPDF.exe loading unexpected DLLs
Network Indicators:
- Outbound connections from UPDF.exe to unexpected destinations
SIEM Query:
EventID=4663 OR EventID=4656 AND ObjectName LIKE '%UPDF%FREngine%Bin64%'