CVE Alert: CVE-2025-12341 – ermig1979 – AntiDupl

Risk verdict

High risk with PoC exploitation available and local access required; urgent attention and rapid review recommended.

Why this matters

The vulnerability permits a local attacker to manipulate the Delete Duplicate Image Handler, gaining total impact on the host and potentially accessing or corrupting image data. In enterprise contexts, affected workstations or developer machines could be leveraged to pivot within the host or exfiltrate sensitive local data, especially where the application runs with elevated privileges.

Most likely attack path

Adversaries would need local access and limited privileges to trigger the link-following flaw, with no user interaction required. Once triggered, the attacker could compromise the host’s integrity, confidentiality and availability of affected image assets, and, given unchanged scope, effects are contained to the vulnerable component but may extend to the host if privileges are high.

Who is most exposed

Desktop users running the affected AntiDupl installation on Windows are most at risk, particularly in organisations where the tool is deployed on endpoints with standard user rights or where admins inadvertently run the app with elevated privileges.

Detection ideas

• Unusual process activity for AntiDupl.NET.WinForms.exe, especially around image-link handling.
• Abnormal file/link manipulations in image directories processed by Delete Duplicate Image Handler.
• Logs showing PoC-like exploit patterns or failed/blocked attempts targeting local file links.
• Unexpected creation or modification of symbolic/ junction links within image folders.
• EDR alerts for anomalous privilege changes or process spawning from the application binary.

Mitigation and prioritisation

• Patch/upgrade to a fixed version or vendor-approved workaround; verify availability and apply promptly.
• Disable or isolate the Delete Duplicate Image Handler feature if remediation cannot be immediate; apply least-privilege and prevent elevation for the component.
• Enforce application whitelisting, endpoint segmentation, and strict user access controls; run the tool under non-privileged accounts where feasible.
• Enhance monitoring and logging around the affected process and image directories; test in a lab before broad rollout.
• If KEV/EPSS signals become known, adjust prioritisation accordingly (treat as priority 1 if confirmed).