CVE-2025-43991

HighCVSS 7.1/10Last modified Oct 18, 2026

Description

SupportAssist for Home PCs versions 4.8.2 and prior and SupportAssist for Business PCs versions 4.5.3 and prior, contain an UNIX Symbolic Link (Symlink) following vulnerability. A low privileged attacker with local access to the system could potentially exploit this vulnerability to delete arbitrary files only in that affected system.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-61

Affected software

No affected versions have been published.

Timeline

Published: Oct 13, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-439925.6Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an authentication bypass by assumed-immut CVE-2025-439937.8Dell Wireless 5932e and Qualcomm Snapdragon X62 Firmware and GNSS/GPS Driver, versions prior to 3.2.0.22 contain an Unquoted Search Path or CVE-2025-439947.5Dell Storage Center - Dell Storage Manager, version(s) DSM 20.1.21, contain(s) a Missing Authentication for Critical Function vulnerability.CVE-2025-439959.8Dell Storage Center - Dell Storage Manager, version(s) 20.1.21, contain(s) an Improper Authentication vulnerability. An unauthenticated atta CVE-2025-440006.1A reflected cross-site scripting (xss) vulnerability exists in the sendOruReport functionality of MedDream PACS Premium 7.3.6.870. A special CVE-2025-440014.0Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to get channel subsc CVE-2025-440026.1Race Condition in the Directory Validation Logic in the TeamViewer Full Client and Host prior version 15.69 on Windows allows a local non-ad CVE-2025-440034.3Missing Release of Resource after Effective Lifetime (CWE-772) in the Gallagher T-Series Reader allows an attacker with physical access to t CVE-2025-440047.2Mattermost Confluence Plugin version <1.5.0 fails to check the authorization of the user to the Mattermost instance which allows attackers t CVE-2025-4400510.0An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without completing certain p CVE-2025-440066.5An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains CVE-2025-440076.5An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains