CVE-2025-1366

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in MicroWord eScan Antivirus 7.0.32 on Linux and classified as critical. Affected by this issue is the function strcpy of the component VirusPopUp. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-121

Affected software

Vendor	Product	Versions
MicroWord	eScan Antivirus	7.0.32

References

https://github.com/dmknght/FIS_RnD/blob/main/escan_av_usb_protection_multiple_vulns.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.295970Permissions Required, VDB Entry
https://vuldb.com/?id.295970Third Party Advisory, VDB Entry

Timeline

Published: Feb 17, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-136605.3The Guest Support plugin for WordPress is vulnerable to User Email Disclosure in versions up to, and including, 1.2.3. This is due to the pl CVE-2025-136618.0Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outs CVE-2025-136627.8Improper verification of cryptographic signatures in the patch management component of Ivanti Endpoint Manager prior to version 2024 SU4 SR1 CVE-2025-136636.7Under certain circumstances, the Quartus Prime Pro Installer for Windows does not check the permissions of the Quartus target installation d CVE-2025-136646.7A potential security vulnerability in Quartus® Prime Standard Edition Design Software may allow escalation of privilege.CVE-2025-136656.7The System Console Utility for Windows is vulnerable to a DLL planting vulnerability CVE-2025-136665.3The Helloprint plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.2. This is due to the plugi CVE-2025-136676.4The WP Recipe Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Skill Level' input field in all versions up CVE-2025-136686.7A potential security vulnerability in Quartus® Prime Pro Edition Design Software may allow escalation of privilege.CVE-2025-136696.7Uncontrolled Search Path Element vulnerability in Altera High Level Synthesis Compiler on Windows allows Search Order Hijacking.This issue a CVE-2025-13675.3A vulnerability was found in MicroWord eScan Antivirus 7.0.32 on Linux. It has been classified as critical. This affects the function sprint CVE-2025-136706.7The High Level Synthesis Compiler i++ command for Windows is vulnerable to a DLL planting vulnerability