CVE-2025-7073: bitdefender antivirus Link Following

Vulnerability summary

CVE-2025-7073 is a high (CVSS 8.8) Link Following vulnerability in bitdefender antivirus. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 5.5% of scored vulnerabilities.

Timeline

1. 10-12-2025
   PublishedVulnerability first disclosed.
2. 31-03-2026
   Last modifiedVulnerability information updated.

Description

A local privilege escalation vulnerability in Bitdefender Total Security versions prior to 27.0.47.241 allows low-privileged attackers to elevate privileges. The issue arises from bdservicehost.exe deleting files from a user-writable directory (C:\ProgramData\Atc\Feedback) without proper symbolic link validation, enabling arbitrary file deletion. This issue is chained with a file copy operation during network events and a filter driver bypass via DLL injection to achieve arbitrary file copy and code execution as elevated user.

• CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.