CVE-2025-2425 MEDIUM

CVE-2025-2425: TOCTOU race condition vulnerability in ESET products on Windows

Vendor Eset, Spol. S.r.o
Product ESET NOD32 Antivirus
Weakness CWE-367
Published July 18, 2025
Last update July 18, 2025
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Time-of-check to time-of-use race condition vulnerability potentially allowed an attacker to use the installed ESET security software to clear the content of an arbitrary file on the file system.

Key dates

02Disclosure timeline

July 18, 2025 CVE published
July 18, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-21455 Time-of-check Time-of-use (TOCTOU) Race Condition in Camera_Linux CVE-2026-25641 SandboxJS has a sandbox escape via TOCTOU bug on keys in property accesses CVE-2022-20907 Cisco Nexus Dashboard Privilege Escalation Vulnerabilities CVE-2023-27327 Parallels Desktop Toolgate Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability CVE-2026-9796 Keycloak: keycloak: privilege escalation via time-of-check to time-of-use (toctou) vulnerability