PT-2025-22383 · Blizzard · Blizzard Battle.Net

CVE-2025-27997 · Publicado 2025-05-21 · Atualizado 2025-12-27

Positive Technologies (AI Summary)

CVSS v3.1

8.4

Alta

Vetor base

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Blizzard Battle.net version 2.40.0.15267

Description The issue allows attackers to escalate privileges by placing a crafted shell script or executable in the C:ProgramData directory. This enables them to gain elevated access, potentially leading to further system compromise.

Recommendations For Blizzard Battle.net version 2.40.0.15267, consider restricting write access to the C:ProgramData directory to prevent malicious scripts or executables from being placed there until a patch is available.

Correção

LPE

Uncontrolled Search Path Element

Enumeração de Fraquezas

CWE-427

Identificadores relacionados

CVE-2025-27997

Produtos afetados

Blizzard Battle.Net

Referências · 9

• https://osv.dev/vulnerability/CVE-2025-27997 · Aviso do Fabricante
• https://t.me/cvenotify/124469 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2005031816139309515 · Publicação no Twitter
• https://reddit.com/r/Overwatch/comments/1mc001h/is_battlenet_installer_compromised_tried_posting · Publicação no Reddit
• https://twitter.com/dailycve/status/1929912914317607116 · Publicação no Twitter
• https://gist.github.com/sornram9254/4593dd5eb2bcca50d68dc6ac70e40b24 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-27997 · Nota de Segurança
• https://t.me/cvetracker/24379 · Publicação no Telegram
• https://reddit.com/r/cybersecurity/comments/1mc043j/has_blizzard_been_compromised_does_the_battlenet · Publicação no Reddit