High severity · published Jul 15, 2025
CVE-2025-34109
Panda Security PSEvents.exe Insecure DLL Loading Privilege Escalation
8.5
CVSS
0.4%
EPSS
No
On KEV
Description
PSEvents.exe in multiple Panda Security products runs hourly with SYSTEM privileges and loads DLL files from a user-writable directory without proper validation. An attacker with low-privileged access who can write DLL files to the monitored directory can achieve arbitrary code execution with SYSTEM privileges. Affected products include Panda Global Protection 2016, Panda Antivirus Pro 2016, Panda Small Business Protection, and Panda Internet Security 2016 (all versions up to 16.1.2).
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
Panda Antivirus Pro 2016 · Panda Security
through 16.1.2 · source: vendor
PG
Panda Global Protection 2016 · Panda Security
through 16.1.2 · source: vendor
PI
Panda Internet Security 2016 · Panda Security
through 16.1.2 · source: vendor
PS
Panda Small Business Protection · Panda Security
through 16.1.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-34109
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-34109
raw.githubusercontent.com
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/local/panda_psevents.rb
web.archive.org
https://web.archive.org/web/20160704105329/http://www.pandasecurity.com/uk/support/card?id=100053
web.archive.org
https://web.archive.org/web/20170415211828/http://www.security-assessment.com/files/documents/advisory/Panda%20Security%20-%20Privilege%20Escalation.pdf
www.exploit-db.com
https://www.exploit-db.com/exploits/40020
www.vulncheck.com
https://www.vulncheck.com/advisories/panda-security-psevents-insecure-dll-loading-privilege-escalation