Skip to content

Local Privilege Escalation in Rufus 4.6 and previous versions

Moderate
pbatard published GHSA-p8p5-r296-g2jv Feb 18, 2025

Package

No package listed

Affected versions

< 4.6

Patched versions

4.7

Description

Impact

A DLL hijacking vulnerability in Rufus 4.6.2208 and earlier versions allows an attacker loading and executing a malicious DLL with escalated privileges (since the executable has been granted higher privileges during the time of launch) due to the ability to inject a malicious cfgmgr32.dll in the same directory as the executable and have it side load automatically. Versions 4.7 and later are not affected by this vulnerability.

Patches

This is fixed in 74dfa49, which is included in version 4.7 that was released on 2025.04.09.

Credits

This vulnerability was discovered by @EmperialX working with @Shauryae1337 and reported by @EmperialX.

Severity

Moderate

CVE ID

CVE-2025-26624

Weaknesses

Untrusted Search Path

The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. Learn more on MITRE.

Uncontrolled Search Path Element

The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. Learn more on MITRE.

Credits