CVE-2025-67905

HighLPE

Published: 17 February 2026

Published

17 February 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 8.7 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

EPSS Score 0.0001 1.9th percentile

Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-67905 is a high-severity Improper Privilege Management (CWE-269) vulnerability in Malwarebytes AdwCleaner (inferred from references). Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 1.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly remediates the privilege escalation vulnerability by identifying, reporting, and applying the vendor patch in AdwCleaner v8.7.0 that fixes the insecure user-controllable log file deletion.

AC-6 Least Privilege good match

prevent

Enforces least privilege on the AdwCleaner process to prevent it from running with Administrator rights necessary for symbolic link-based escalation to SYSTEM privileges.

CM-7 Least Functionality partial match

prevent

Restricts AdwCleaner to least functionality by prohibiting or limiting non-essential user-controllable file deletion operations that enable the symlink exploitation vector.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

Local privilege escalation via insecure file deletion and symbolic link abuse in a high-privileged process directly matches Exploitation for Privilege Escalation.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Malwarebytes AdwCleaner before v.8.7.0 runs as Administrator and performs an insecure log file delete operation in which the target location is user-controllable, allowing a non-admin user to escalate privileges to SYSTEM via a symbolic link, a related issue to CVE-2023-28892.…

To exploit this, an attacker must create a file in a given folder path and intercept the application log file deletion flow.

Deeper analysisAI

CVE-2025-67905 is a privilege escalation vulnerability in Malwarebytes AdwCleaner versions prior to 8.7.0. The application runs with Administrator privileges and performs an insecure log file deletion operation where the target location is user-controllable. This flaw allows exploitation via a symbolic link, similar to CVE-2023-28892, and is classified under CWE-269 (Improper Privilege Management). The vulnerability carries a CVSS v3.1 base score of 8.7 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L), indicating high severity due to its local attack vector, low complexity, and significant impact on confidentiality, integrity, and availability in a changed scope.

A non-administrative user can exploit this vulnerability by creating a file in a specific folder path and intercepting the application's log file deletion flow. Successful exploitation elevates the attacker's privileges to SYSTEM level, potentially enabling full control over the affected system, including unauthorized access to sensitive data and further persistence or lateral movement.

Malwarebytes advisories, available at https://www.malwarebytes.com/secure/cves/cve-2025-67905 and https://Malwarebytes.com, address this issue in AdwCleaner version 8.7.0, which resolves the insecure deletion mechanism. Security practitioners should ensure systems are updated to version 8.7.0 or later to mitigate the risk.