CVE-2025-67905
Published: 17 February 2026
Summary
CVE-2025-67905 is a high-severity Improper Privilege Management (CWE-269) vulnerability in Malwarebytes AdwCleaner (inferred from references). Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 3.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-67905 is a privilege escalation vulnerability in Malwarebytes AdwCleaner versions prior to 8.7.0. The application runs with Administrator privileges and performs an insecure log file deletion operation where the target location is user-controllable. This flaw allows exploitation via a symbolic link, similar to CVE-2023-28892, and is classified under CWE-269 (Improper Privilege Management). The vulnerability carries a CVSS v3.1 base score of 8.7 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L), indicating high severity due to its local attack vector, low complexity, and significant impact on confidentiality, integrity, and availability in a changed scope.
A non-administrative user can exploit this vulnerability by creating a file in a specific folder path and intercepting the application's log file deletion flow. Successful exploitation elevates the attacker's privileges to SYSTEM level, potentially enabling full control over the affected system, including unauthorized access to sensitive data and further persistence or lateral movement.
Malwarebytes advisories, available at https://www.malwarebytes.com/secure/cves/cve-2025-67905 and https://Malwarebytes.com, address this issue in AdwCleaner version 8.7.0, which resolves the insecure deletion mechanism. Security practitioners should ensure systems are updated to version 8.7.0 or later to mitigate the risk.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-207699
Vulnerability details
Malwarebytes AdwCleaner before v.8.7.0 runs as Administrator and performs an insecure log file delete operation in which the target location is user-controllable, allowing a non-admin user to escalate privileges to SYSTEM via a symbolic link, a related issue to CVE-2023-28892.…
more
To exploit this, an attacker must create a file in a given folder path and intercept the application log file deletion flow.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local privilege escalation via insecure file deletion and symbolic link abuse in a high-privileged process directly matches Exploitation for Privilege Escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the privilege escalation vulnerability by identifying, reporting, and applying the vendor patch in AdwCleaner v8.7.0 that fixes the insecure user-controllable log file deletion.
Enforces least privilege on the AdwCleaner process to prevent it from running with Administrator rights necessary for symbolic link-based escalation to SYSTEM privileges.
Restricts AdwCleaner to least functionality by prohibiting or limiting non-essential user-controllable file deletion operations that enable the symlink exploitation vector.