PT-2025-22383 · Blizzard · Blizzard Battle.Net

Published 2025-05-21 · Updated 2025-12-27 · CVE-2025-27997

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Blizzard Battle.net version 2.40.0.15267

Description The issue allows attackers to escalate privileges by placing a crafted shell script or executable in the C:ProgramData directory. This enables them to gain elevated access, potentially leading to further system compromise.

Recommendations For Blizzard Battle.net version 2.40.0.15267, consider restricting write access to the C:ProgramData directory to prevent malicious scripts or executables from being placed there until a patch is available.

Fix

LPE

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2025-27997

Affected Products

Blizzard Battle.Net

References · 9

• https://osv.dev/vulnerability/CVE-2025-27997 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27997 · Security Note
• https://t.me/cvenotify/124469 · Telegram Post
• https://twitter.com/CVEnew/status/2005031816139309515 · Twitter Post
• https://reddit.com/r/Overwatch/comments/1mc001h/is_battlenet_installer_compromised_tried_posting · Reddit Post
• https://twitter.com/dailycve/status/1929912914317607116 · Twitter Post
• https://gist.github.com/sornram9254/4593dd5eb2bcca50d68dc6ac70e40b24 · Note
• https://t.me/cvetracker/24379 · Telegram Post
• https://reddit.com/r/cybersecurity/comments/1mc043j/has_blizzard_been_compromised_does_the_battlenet · Reddit Post