CVE-2025-0131: GlobalProtect App: Incorrect Privilege Management Vulnerability in OPSWAT MetaDefender Endpoint Security SDK (Severity: MEDIUM)

Q: What is the severity of CVE-2025-0131?

CVE-2025-0131 is classified as a high-severity vulnerability due to its potential for privilege escalation.

Q: How do I fix CVE-2025-0131?

To mitigate CVE-2025-0131, ensure you update to a patched version of the OPSWAT MetaDefender Endpoint Security SDK beyond version 4.3.4451.

Q: Who is affected by CVE-2025-0131?

CVE-2025-0131 affects locally authenticated non-administrative Windows users running specific versions of OPSWAT MetaDefender Endpoint Security SDK.

Q: What type of vulnerability is CVE-2025-0131?

CVE-2025-0131 is an incorrect privilege management vulnerability that allows unauthorized privilege escalation.

Q: What products are involved in CVE-2025-0131?

The affected product involved in CVE-2025-0131 is the OPSWAT MetaDefender Endpoint Security SDK used in the Palo Alto Networks GlobalProtect app.

Published May 14, 2025

Updated

An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM. However, execution requires that the local user also successfully exploits a race condition, which makes this vulnerability difficult to exploit.

Affected Software

2 affected componentsFixes available

All of the following

OPSWAT MetaDefender Endpoint Security SDK<4.3.4451, =4.3.0

4.3.4451

Microsoft Windows*

Remediation

Mitigation

No known workarounds or mitigations exist for this issue.

Information

This issue is fixed in MetaDefender Endpoint Security SDK 4.3.4451 on Windows, and all later MetaDefender Endpoint Security SDK versions on Windows. To mitigate this issue in the GlobalProtect App on Windows update to one of the listed versions (these versions include the updated MetaDefender Endpoint Security SDK): VERSION SUGGESTED SOLUTION GlobalProtect App 6.3 on Windows Upgrade to 6.3.3 or later GlobalProtect App 6.2 on Windows Upgrade to 6.2.8 or later GlobalProtect App 6.1 on Windows Upgrade to 6.2.8 or later or 6.3.3 or later GlobalProtect App 6.0 on Windows Upgrade to 6.2.8 or later or 6.3.3 or later GlobalProtect App on macOS Not applicable GlobalProtect App on Linux Not applicable GlobalProtect App on iOS Not applicable GlobalProtect App on Android Not applicable GlobalProtect UWP App Not applicable

Event History

May 14, 2025

Advisory Published

via Palo Alto Networks·04:00 PM

CVE Published

via MITRE·06:06 PM

Data Sourced

via MITRE·06:06 PM

DescriptionWeakness

Data Sourced

via NVD·07:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-0131?