CVE-2025-0131 GlobalProtect App: Incorrect Privilege Management Vulnerability in OPSWAT MetaDefender Endpoint Security SDK
🔗 CVE IDs covered (1)
📋 Description
An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM. However, execution requires that the local user also successfully exploits a race condition, which makes this vulnerability difficult to exploit.
🎯 Affected products1
- MetaDefender Endpoint Security SDK
✅ Remediation
This issue is fixed in MetaDefender Endpoint Security SDK 4.3.4451 on Windows, and all later MetaDefender Endpoint Security SDK versions on Windows. To mitigate this issue in the GlobalProtect App on Windows update to one of the listed versions (these versions include the updated MetaDefender Endpoint Security SDK): VERSION SUGGESTED SOLUTION GlobalProtect App 6.3 on Windows Upgrade to 6.3.3 or later GlobalProtect App 6.2 on Windows Upgrade to 6.2.8 or later GlobalProtect App 6.1 on Windows Upgrade to 6.2.8 or later or 6.3.3 or later GlobalProtect App 6.0 on Windows Upgrade to 6.2.8 or later or 6.3.3 or later GlobalProtect App on macOS Not applicable GlobalProtect App on Linux Not applicable GlobalProtect App on iOS Not applicable GlobalProtect App on Android Not applicable GlobalProtect UWP App Not applicable Workarounds and mitigations: No known workarounds or mitigations exist for this issue.