PT-2025-31854 · Macrium+1 · Reflectmonitor.Exe+2

Published 2025-08-04 · Updated 2025-08-04 · CVE-2025-53395

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Macrium Reflect versions through 2025-06-26

Description Macrium Reflect allows local attackers to execute arbitrary code with administrator privileges via a crafted .mrimgx backup file and a malicious VSSSvr.dll located in the same directory. When a user with administrative privileges mounts a backup by opening the .mrimgx file, Reflect loads the attacker's VSSSvr.dll after the mount completes. This occurs due to untrusted DLL search path behavior in ReflectMonitor.exe.

Recommendations Versions prior to 2025-06-26 should be updated. As a temporary workaround, avoid opening .mrimgx backup files from untrusted sources. Restrict access to the ReflectMonitor.exe file to minimize the risk of exploitation.

Fix

LPE

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2025-53395

Affected Products

Macrium Reflect

Reflectmonitor.Exe

Vsssvr.Dll

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-53395 · Security Note
• https://t.me/CVEtracker/29120 · Telegram Post
• https://twitter.com/CVEnew/status/1952443679341170711 · Twitter Post
• https://macrium.com/blog/macrium-security-advisory-cve-2025-53394-cve-2025-53395 · Note
• https://macrium.com · Note