Privilege escalation in K7computing K7 Ultimate Security
CVE-2025-67826
An issue was discovered in K7 Ultimate Security 17.0.2045. A Local Privilege Escalation (LPE) vulnerability in the K7 Ultimate Security antivirus can be exploited by a local unprivileged user on default installations of the product. Insecure access to a named pipe allows unprivileged users to edit any registry key, leading to a full compromise as SYSTEM.
Vulnerability class: Privilege Escalation
EPSS: 0.001 (3.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
Affected products
- K7computing K7_ultimate_security — versions 17.0.2045
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Product)
- cve@mitre.org (Vendor Advisory)
Frequently asked questions
- What is CVE-2025-67826?
- CVE-2025-67826 is a high-severity vulnerability in K7computing K7 Ultimate Security, classified under Improper Privilege Management. CVSS score: 7.7/10. Published 2025-12-22.
- How severe is CVE-2025-67826?
- High severity. CVSS v3 base score is 7.7 out of 10.