CVE-2025-10215: 
Homebrew vulnerability analysis and mitigation

CVE-2025-10215 is a DLL search path hijacking vulnerability in the UPDF PDF editor for Windows, specifically affecting version 1.8.5.0. The flaw exists in the UPDF.exe executable, which insecurely loads FREngine.dll from a user-writable directory. It was published on September 10, 2025, and assigned by INCIBE. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 7.0 (High) (Feedly, ENISA EUVD).

The vulnerability is classified as CWE-427 (Uncontrolled Search Path Element). When UPDF.exe launches, it searches for FREngine.dll in the directory C:\Users\Public\AppData\Local\UPDF\FREngine\Bin64\, which is writable by non-privileged local users due to its location under C:\Users\Public. An attacker with local access can place a malicious FREngine.dll in this path; when a legitimate user subsequently launches UPDF, Windows loads the attacker-controlled DLL instead of the legitimate one, executing arbitrary code in the context of the victim user. This technique maps to MITRE ATT&CK T1574.001 (DLL Search Order Hijacking) (Feedly, ENISA EUVD).

Successful exploitation grants the attacker arbitrary code execution in the security context of the user who launches UPDF, with high impact to confidentiality, integrity, and availability. Because the malicious DLL persists in the writable directory, the attacker can achieve persistence — the payload executes every time the victim opens UPDF. This could facilitate credential theft, data exfiltration, or further lateral movement within the environment (Feedly, ENISA EUVD).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of publication. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term. Exploitation requires local access and user interaction (the victim must launch UPDF), limiting the attack surface (Feedly).

1. Gain local access: Obtain a foothold on the target Windows system through any means (e.g., phishing, existing malware, or physical access) with at least standard user privileges.
2. Identify the target directory: Confirm that UPDF version 1.8.5.0 is installed and that the directory C:\Users\Public\AppData\Local\UPDF\FREngine\Bin64\ exists and is writable.
3. Craft a malicious DLL: Compile a malicious FREngine.dll that executes the desired payload (e.g., a reverse shell, credential harvester, or persistence mechanism) while optionally proxying calls to the legitimate DLL to avoid detection.
4. Place the malicious DLL: Copy the crafted FREngine.dll into C:\Users\Public\AppData\Local\UPDF\FREngine\Bin64\, overwriting or replacing any existing file.
5. Wait for victim interaction: When any user on the system launches UPDF.exe, Windows resolves the DLL search path and loads the attacker-controlled FREngine.dll, executing the malicious payload in the victim user's security context (Feedly, ENISA EUVD).

• File System: Unexpected or recently modified FREngine.dll in C:\Users\Public\AppData\Local\UPDF\FREngine\Bin64\; file hash mismatch compared to the legitimate UPDF installation.
• Process: Unusual child processes spawned by UPDF.exe (e.g., cmd.exe, powershell.exe, curl.exe) shortly after application launch; unexpected network connections originating from the UPDF process.
• Logs: Windows Event Log entries (Event ID 7 - Image Loaded) showing FREngine.dll loaded from C:\Users\Public\AppData\Local\UPDF\FREngine\Bin64\ with an unexpected digital signature or no signature; Sysmon DLL load events for the same path with an unknown or unsigned module.

Users should update UPDF to a version newer than 1.8.5.0 once a patched release is made available by the vendor. As an interim workaround, administrators can restrict write permissions on the directory C:\Users\Public\AppData\Local\UPDF\FREngine\Bin64\ to prevent non-privileged users from placing files there. Additionally, application whitelisting solutions (e.g., Windows Defender Application Control) can be configured to block unsigned or untrusted DLLs from loading within the UPDF process (INCIBE Advisory, ENISA EUVD).

The vulnerability was assigned and disclosed by INCIBE-CERT (Spain's national cybersecurity incident response team) and registered in the ENISA European Vulnerability Database (EUVD-2025-27531). A LinkedIn post referencing the CVE was noted in late June 2025, suggesting limited but emerging community awareness. No significant vendor statements or major media coverage have been identified beyond the initial advisory (ENISA EUVD).