CVE-2025-34109

Deeper analysis

PSEvents.exe in multiple Panda Security products runs hourly with SYSTEM privileges and loads DLL files from a user-writable directory without proper validation. The affected products are Panda Global Protection 2016, Panda Antivirus Pro 2016, Panda Small Business Protection, and Panda Internet Security 2016, all versions up to 16.1.2. The issue is tracked as CWE-427 and carries a CVSS 4.0 score of 8.5 for local attack vectors.

An attacker with low-privileged access who can place a malicious DLL in the monitored directory can obtain arbitrary code execution as SYSTEM. The process executes on an hourly schedule, providing a recurring opportunity for privilege escalation once the DLL is written.

Public references include a Metasploit module, an Exploit-DB entry, a 2016 security-assessment advisory, and a VulnCheck advisory that document the insecure DLL loading behavior. The EPSS score stands at 0.0987 with no material change from its recorded peak.