CVE-2025-67826

HighCVSS 7.7/10Last modified Nov 4, 2026

Description

An issue was discovered in K7 Ultimate Security 17.0.2045. A Local Privilege Escalation (LPE) vulnerability in the K7 Ultimate Security antivirus can be exploited by a local unprivileged user on default installations of the product. Insecure access to a named pipe allows unprivileged users to edit any registry key, leading to a full compromise as SYSTEM.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-22nd-Dec-2025Vendor Advisory
https://www.k7computing.com/Product

Timeline

Published: Dec 22, 2025
Last modified: Nov 4, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-678299.8Mura before 10.1.14 allows beanFeed.cfc getQuery sortDirection SQL injection.CVE-2025-67837.5The GoZen Forms plugin for WordPress is vulnerable to SQL Injection via the 'forms-id' parameter of the emdedSc() function in all versions u CVE-2025-678309.8Mura before 10.1.14 allows beanFeed.cfc getQuery sortby SQL injection.CVE-2025-678336.1Paessler PRTG Network Monitor before 25.4.114 allows XSS by an unauthenticated attacker via the tag parameter.CVE-2025-678345.4Paessler PRTG Network Monitor before 25.4.114 allows XSS by an unauthenticated attacker via the filter parameter.CVE-2025-678356.5Paessler PRTG Network Monitor before 25.4.114 allows Denial-of-Service (DoS) by an authenticated attacker via the Notification Contacts func CVE-2025-67848.8The Code Engine plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.3.5 via the 'code-engine CVE-2025-678407.2Multiple authenticated OS command injection vulnerabilities exist in the Cohesity (formerly Stone Ram) TranZman 4.0 Build 14614 through TZM_CVE-2025-678417.5Nordic Semiconductor IronSide SE for nRF54H20 before 23.0.2+17 has an Algorithmic complexity issue.CVE-2025-678425.4The Static Asset API in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via the subdomain CVE-2025-678439.8A Server-Side Template Injection (SSTI) vulnerability in the MDX Rendering Engine in Mintlify Platform before 2025-11-15 allows remote attac CVE-2025-678444.3The GitHub Integration API in Mintlify Platform before 2025-11-15 allows remote attackers to obtain sensitive repository metadata via the re