CVE-2025-53394

HighCVSS 7.7/10Last modified Jun 17, 2026

Description

Paramount Macrium Reflect through 2025-06-26 allows attackers to execute arbitrary code with administrator privileges via a crafted .mrimgx or .mrbax backup file and a renamed executable placed in the same directory. When a user with administrative privileges opens the crafted backup file and proceeds to mount it, Reflect launches the renamed executable (e.g., explorer.exe), which is under attacker control. This occurs because of insufficient validation of companion files referenced during backup mounting.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

No affected versions have been published.

Timeline

Published: Aug 4, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-533957.7Paramount Macrium Reflect through 2025-06-26 allows local attackers to execute arbitrary code with administrator privileges via a crafted .m CVE-2025-533967.3Incorrect permission assignment for critical resource issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier), whi CVE-2025-533976.1A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site scripting (XSS) att CVE-2025-533987.8The Portrait Dell Color Management application 3.3.8 for Dell monitors has Insecure Permissions,CVE-2025-533996.9In Sipwise rtpengine before 13.4.1.1, an origin-validation error in the endpoint-learning logic of the media-relay core allows remote attack CVE-2025-53406.4The Music Player for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘album_buy_url’ parameter in all ve CVE-2025-534054.9A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an a CVE-2025-534066.5A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote a CVE-2025-534076.5A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote a CVE-2025-534086.5A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can the CVE-2025-534096.5An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains CVE-2025-53416.4The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi