---
id: CVE-2025-7073
title: "A local privilege escalation vulnerability in Bitdefender Total Security versions prior to 27.0.47.241\_allows low-privileged attackers to elevate privileges"
summary: "A local privilege escalation vulnerability in Bitdefender Total Security versions prior to 27.0.47.241\_allows low-privileged attackers to elevate privileges. The issue arises from bdservicehost.exe\_deleting files from a user-writable dir…"
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-59
vendor: bitdefender
product: antivirus
affected:
  - antivirus < 30.0.25.77
  - antivirus_plus < 27.0.47.241
  - endpoint_security_tools < 7.9.20.515
  - internet_security < 27.0.47.241
  - total_security < 27.0.47.241
patched:
  - antivirus 30.0.25.77
  - antivirus_plus 27.0.47.241
  - endpoint_security_tools 7.9.20.515
  - internet_security 27.0.47.241
  - total_security 27.0.47.241
published: '2025-12-10'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T21:10:00.183'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-7073'
references:
  - url: >-
      https://www.bitdefender.com/support/security-advisories/local-privilege-escalation-via-arbitrary-file-operation-in-bitdefender-atc-va-12590
    label: cve-requests@bitdefender.com
tags:
  - nvd
epss: 0.00166
epssPercentile: 0.05479
ingestedAt: '2026-10-14T21:57:04.781Z'
---

## Overview

A local privilege escalation vulnerability in Bitdefender Total Security versions prior to 27.0.47.241 allows low-privileged attackers to elevate privileges. The issue arises from bdservicehost.exe deleting files from a user-writable directory (C:\ProgramData\Atc\Feedback) without proper symbolic link validation, enabling arbitrary file deletion. This issue is chained with a file copy operation during network events and a filter driver bypass via DLL injection to achieve arbitrary file copy and code execution as elevated user.

## Affected

- `antivirus < 30.0.25.77`
- `antivirus_plus < 27.0.47.241`
- `endpoint_security_tools < 7.9.20.515`
- `internet_security < 27.0.47.241`
- `total_security < 27.0.47.241`

## Remediation

Upgrade past the affected range:

- `antivirus 30.0.25.77`
- `antivirus_plus 27.0.47.241`
- `endpoint_security_tools 7.9.20.515`
- `internet_security 27.0.47.241`
- `total_security 27.0.47.241`