CVE-2025-11178

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11178", "assignerOrgId": "73dc0fef-1c66-4a72-9d2d-0a0f4012c175", "state": "PUBLISHED", "assignerShortName": "Acronis", "dateReserved": "2025-09-29T22:35:29.171Z", "datePublished": "2025-09-30T14:52:20.711Z", "dateUpdated": "2026-04-10T13:16:25.613Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "73dc0fef-1c66-4a72-9d2d-0a0f4012c175", "shortName": "Acronis", "dateUpdated": "2026-04-10T13:16:25.613Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-427", "description": "CWE-427", "type": "CWE"}]}], "affected": [{"vendor": "Acronis", "product": "Acronis True Image", "platforms": ["Windows"], "versions": [{"version": "unspecified", "status": "affected", "lessThan": "42386", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Acronis", "product": "Acronis True Image for Western Digital", "platforms": ["Windows"], "versions": [{"version": "unspecified", "status": "affected", "lessThan": "42636", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Acronis", "product": "Acronis True Image for SanDisk", "platforms": ["Windows"], "versions": [{"version": "unspecified", "status": "affected", "lessThan": "42679", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Acronis", "product": "Acronis True Image OEM", "platforms": ["Windows"], "versions": [{"version": "unspecified", "status": "affected", "lessThan": "42575", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis True Image (Windows) before build 42386, Acronis True Image for Western Digital (Windows) before build 42636, Acronis True Image for SanDisk (Windows) before build 42679, Acronis True Image OEM (Windows) before build 42575."}], "references": [{"url": "https://security-advisory.acronis.com/advisories/SEC-7078", "name": "SEC-7078", "tags": ["vendor-advisory"]}], "credits": [{"lang": "en", "value": "@satz4797 (https://hackerone.com/satz4797)", "type": "finder"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_0": {"version": "3.0", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"}}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11178", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-01T03:55:57.464131Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T17:47:47.868Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11178", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-01T03:55:57.464131Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-30T15:27:49.865Z"}}], "cna": {"credits": [{"lang": "en", "type": "finder", "value": "@satz4797 (https://hackerone.com/satz4797)"}], "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Acronis", "product": "Acronis True Image", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "42386", "versionType": "semver"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}, {"vendor": "Acronis", "product": "Acronis True Image for Western Digital", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "42636", "versionType": "semver"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}, {"vendor": "Acronis", "product": "Acronis True Image for SanDisk", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "42679", "versionType": "semver"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}, {"vendor": "Acronis", "product": "Acronis True Image OEM", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "42575", "versionType": "semver"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "references": [{"url": "https://security-advisory.acronis.com/advisories/SEC-7078", "name": "SEC-7078", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis True Image (Windows) before build 42386, Acronis True Image for Western Digital (Windows) before build 42636, Acronis True Image for SanDisk (Windows) before build 42679, Acronis True Image OEM (Windows) before build 42575."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-427", "description": "CWE-427"}]}], "providerMetadata": {"orgId": "73dc0fef-1c66-4a72-9d2d-0a0f4012c175", "shortName": "Acronis", "dateUpdated": "2026-04-10T13:16:25.613Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11178", "state": "PUBLISHED", "dateUpdated": "2026-04-10T13:16:25.613Z", "dateReserved": "2025-09-29T22:35:29.171Z", "assignerOrgId": "73dc0fef-1c66-4a72-9d2d-0a0f4012c175", "datePublished": "2025-09-30T14:52:20.711Z", "assignerShortName": "Acronis"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "Acronis True Image", "vendor": "Acronis", "versions": [{"lessThan": "42386", "status": "affected", "version": "unspecified", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "Acronis True Image for Western Digital", "vendor": "Acronis", "versions": [{"lessThan": "42636", "status": "affected", "version": "unspecified", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "Acronis True Image for SanDisk", "vendor": "Acronis", "versions": [{"lessThan": "42679", "status": "affected", "version": "unspecified", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "Acronis True Image OEM", "vendor": "Acronis", "versions": [{"lessThan": "42575", "status": "affected", "version": "unspecified", "versionType": "semver"}]}], "source": "security@acronis.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis True Image (Windows) before build 42386, Acronis True Image for Western Digital (Windows) before build 42636, Acronis True Image for SanDisk (Windows) before build 42679, Acronis True Image OEM (Windows) before build 42575."}, {"lang": "es", "value": "Escalada de privilegios local debido a una vulnerabilidad de secuestro de DLL. Los siguientes productos est\u00e1n afectados: Acronis True Image (Windows) anterior a la compilaci\u00f3n 42386, Acronis True Image para Western Digital (Windows) anterior a la compilaci\u00f3n 42636, Acronis True Image para SanDisk (Windows) anterior a la compilaci\u00f3n 42679."}], "id": "CVE-2025-11178", "lastModified": "2026-06-17T08:29:48.423", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.3, "impactScore": 5.9, "source": "security@acronis.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11178", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-10-01T03:55:57.464131Z", "version": "2.0.3"}}]}, "published": "2025-09-30T15:15:47.863", "references": [{"source": "security@acronis.com", "url": "https://security-advisory.acronis.com/advisories/SEC-7078"}], "sourceIdentifier": "security@acronis.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-427"}], "source": "security@acronis.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T17:51:49.224626+00:00", "value": {"mitigation_remediation": ["Upgrade to the latest Acronis True Image for Windows release that is newer than build 42386 (and the corresponding newer builds for OEM, SanDisk, and Western Digital editions).", "If an upgrade cannot be performed immediately, restrict DLL search order by ensuring that the directory containing the vulnerable DLL is not writable by unprivileged users, or apply software restriction policies that prevent execution of DLL files from non\u2011trusted locations.", "Continuously monitor the system for unexpected DLLs or file creation events in application directories and enforce strict permissions on those folders to reduce the risk of DLL hijacking."], "summary": {"action": "Apply Upgrade", "impact": "Local Privilege Escalation"}, "threat_synthesis": {"affected_systems": "Affected products include Acronis True Image for Windows and its OEM, SanDisk, and Western Digital editions. The vulnerability exists in builds before 42386 for the standard product, before 42636 for the Western Digital version, before 42679 for the SanDisk version, and before 42575 for the OEM edition.", "description_and_impact": "Acronis True Image software on Windows can be abused from an unprivileged user to gain elevated local privileges through a DLL hijacking flaw. The weakness allows an attacker to place a malicious DLL in a directory that precedes the legitimate DLL in the search path, causing the application to load the attacker-controlled code. The result is that the attacker can execute arbitrary code with the same privileges as the application, which typically run with administrative rights, leading to full system compromise.", "risk_and_exploitability": "The CVSS score of 7.3 indicates a high severity local privilege escalation risk, while the EPSS score of less than 1% suggests that widespread exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local access to the machine and the ability to place a DLL in a directory that the application scans before its installed location, which may be feasible in environments where unprivileged users have write permissions to temporary or program directories. Once executed, the attacker immediately gains elevated rights, posing an immediate threat to system confidentiality, integrity, and availability."}}}}, "created": "2025-10-02T08:46:12.665001+00:00", "title": "DLL Hijacking Leading to Local Privilege Escalation in Acronis True Image", "updated": "2026-04-20T18:00:11.160965+00:00", "vendors": ["acronis", "acronis$PRODUCT$true_image", "microsoft", "microsoft$PRODUCT$windows"]}