CVE-2025-26624: Local Privilege Escalation in Rufus 4.6 and previous versions
Rufus is a utility that helps format and create bootable USB flash drives. A DLL hijacking vulnerability in Rufus 4.6.2208 and earlier versions allows an attacker loading and executing a malicious DLL with escalated privileges (since the executable has been granted higher privileges during the time of launch) due to the ability to inject a malicious cfgmgr32.dll in the same directory as the executable and have it side load automatically. This is fixed in commit 74dfa49, which will be part of version 4.7. Users are advised to upgrade as soon as version 4.7 becomes available. There are no known workarounds for this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rufusto a version that resolves this vulnerability.Fixed in 4.7Patch 74dfa49
Event History
Frequently Asked Questions
What is the severity of CVE-2025-26624?
CVE-2025-26624 has been classified as a high severity vulnerability due to its capability of allowing escalated privilege execution of a malicious DLL.
How do I fix CVE-2025-26624?
To fix CVE-2025-26624, update to Rufus version 4.6.2209 or later, which addresses the DLL hijacking vulnerability.
What does CVE-2025-26624 affect?
CVE-2025-26624 affects Rufus versions 4.6.2208 and earlier, specifically allowing DLL hijacking exploits.
How can an attacker exploit CVE-2025-26624?
An attacker can exploit CVE-2025-26624 by placing a malicious DLL in a location where Rufus will load it, which can lead to execution with higher privileges.
Is CVE-2025-26624 limited to specific operating systems?
CVE-2025-26624 is not limited to specific operating systems as it directly concerns how the Rufus application handles DLL loading.