PT-2025-7219 · Rufus · Rufus

Emperialx · Published 2025-02-18 · Updated 2025-02-19 · CVE-2025-26624

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Rufus versions 4.6.2208 and earlier

Description: Rufus is a utility that helps format and create bootable USB flash drives. A DLL hijacking vulnerability in Rufus allows an attacker to load and execute a malicious DLL with escalated privileges due to the ability to inject a malicious cfgmgr32.dll in the same directory as the executable and have it side load automatically.

Recommendations: For Rufus versions 4.6.2208 and earlier, upgrade to version 4.7 as soon as it becomes available to fix the vulnerability. At the moment, there is no information about other workarounds for this vulnerability.

Exploit

Fix

Untrusted Search Path

Uncontrolled Search Path Element

Weakness Enumeration

CWE-426

CWE-427

Related Identifiers

CVE-2025-26624

GHSA-P8P5-R296-G2JV

Affected Products

Rufus

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/26xxx/CVE-2025-26624.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-26624 · Security Note
• https://osv.dev/vulnerability/CVE-2025-26624 · Vendor Advisory
• https://github.com/pbatard/rufus/commit/74dfa49707fd626b58d776d3400295740a29e23e · Note
• https://github.com/pbatard/rufus/security/advisories/GHSA-p8p5-r296-g2jv · Note
• https://twitter.com/WolfgangSesin/status/1892004606772703466 · Twitter Post
• https://twitter.com/CVEnew/status/1891983720891957689 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1892097822662553745 · Twitter Post
• https://t.me/cvedetector/18378 · Telegram Post