CVE-2025-67826

HIGH

K7computing K7 Ultimate Security - Improper Privilege Management

Title source: rule
STIX 2.1

Description

An issue was discovered in K7 Ultimate Security 17.0.2045. A Local Privilege Escalation (LPE) vulnerability in the K7 Ultimate Security antivirus can be exploited by a local unprivileged user on default installations of the product. Insecure access to a named pipe allows unprivileged users to edit any registry key, leading to a full compromise as SYSTEM.

References (2)

Scores

CVSS v3 7.7
EPSS 0.0002
EPSS Percentile 6.1%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-269
Status published
Products (1)
k7computing/k7_ultimate_security 17.0.2045
Published Dec 22, 2025
Tracked Since Feb 18, 2026