CVE-2017-10950: bitdefender total_security Double Free
Vulnerability summary
CVE-2017-10950 is a high (CVSS 7.0) Double Free vulnerability in bitdefender total_security. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 26.4% of scored vulnerabilities.
Timeline
- 29-08-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of Bitdefender Total Security 21.0.24.62. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within processing of the 0x8000E038 IOCTL in the bdfwfpf driver. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker could leverage this vulnerability to execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-4776.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.34%
Chance of exploitation in the next 30 days
Percentile
26%
Versus all other CVEs
30-day change
0.00 pp
From 0.34% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Bitdefender1 product
- total_security21.0.24.62
Zero day initiative1 product
- bitdefender total security21.0.24.62
2 vendors · 2 products