CVE-2025-3599

MEDIUM

Broadcom Symantec Eraser Engine < 119.1.7.8 - TOCTOU Race Condition

Title source: rule

Description

Symantec Endpoint Protection Windows Agent, running an ERASER Engine prior to 119.1.7.8, may be susceptible to an Elevation of Privilege vulnerability, which may allow an attacker to delete resources that are normally protected from an application or user.

References (1)

[Vendor Advisory] https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25659

Scores

CVSS v3 6.5

EPSS 0.0019

EPSS Percentile 40.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-367

Status published

Products (1)

broadcom/symantec_eraser_engine < 119.1.7.8

Published Apr 30, 2025

Tracked Since Feb 18, 2026