RCE in Trellix Endpoint Security (Hx) Agent
CVE-2025-0664
A locally authenticated, privileged user can craft a malicious OpenSSL configuration file, potentially leading the agent to load an arbitrary local library. This may impair endpoint defenses and allow the attacker to achieve code execution with SYSTEM-level privileges.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.002 (6.5th percentile) — read the EPSS interpretation.
Affected products
- Trellix Endpoint Security (Hx) Agent — versions 36.30.0 and 35.31.28