PT-2025-41312 · Piriform · Ccleaner+1

Published 2025-10-08 · Updated 2025-10-14 · CVE-2017-20201

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions CCleaner versions 5.33.6162 CCleaner Cloud versions 1.07.3191

Description CCleaner and CCleaner Cloud contained a malicious pre-entry-point loader that redirects execution to a custom loader. This loader decodes an embedded blob into shellcode, allocates executable heap memory, resolves Windows API functions at runtime, and transfers execution to an in-memory payload. The payload performs anti-analysis checks, gathers host telemetry, encodes the data with a two-stage obfuscation, and attempts HTTPS exfiltration to hard-coded C2 servers or month-based DGA domains. Potential impacts include remote data collection and exfiltration, stealthy in-memory execution and persistence, and potential lateral movement. The software was developed by Piriform, acquired by Avast, which later merged with NortonLifeLock to form Gen Digital.

Recommendations Update CCleaner to version 5.34. Update CCleaner Cloud to version 1.07.3214.

Fix

RCE

Weakness Enumeration

CWE-506

Related Identifiers

CVE-2017-20201

Affected Products

Ccleaner

Ccleaner Cloud

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2017-20201 · Security Note
• https://blog.avast.com/progress-on-ccleaner-investigation · Note
• https://blog.avast.com/update-to-the-ccleaner-5.33.6162-security-incident · Note
• https://ccleaner.com/knowledge/security-notification-ccleaner-v5336162-ccleaner-cloud-v1073191 · Note
• https://blog.talosintelligence.com/avast-distributes-malware · Note
• https://morphisec.com/blog/morphisec-discovers-ccleaner-backdoor · Note
• https://t.me/cveNotify/137909 · Telegram Post
• https://vulncheck.com/advisories/ccleaner-and-ccleaner-cloud-malicious-backdoor-supply-chain-compromise · Note
• https://ccleaner.com · Note
• https://t.me/cveNotify/138541 · Telegram Post
• https://crowdstrike.com/en-us/blog/protecting-software-supply-chain-deep-insights-ccleaner-backdoor · Note