[Palo Alto Networks Security Advisories] CVE-2025-0131 GlobalProtect App: Incorrect Privilege Management Vulnerability inOPSWAT MetaDefender Endpoint Security SDK

Palo Alto Networks Security Advisories /CVE-2025-0131

CVE-2025-0131 GlobalProtect App: Incorrect Privilege Management Vulnerability in OPSWAT MetaDefender Endpoint Security SDK

Description

An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM. However, execution requires that the local user also successfully exploits a race condition, which makes this vulnerability difficult to exploit.

Product Status

Required Configuration for Exposure

No special configuration is required to be affected by this issue.

Severity:MEDIUM, Suggested Urgency:MODERATE

CVSS-BT:4.0 /CVSS-B:7.1 (CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:U/AU:N/R:U/V:D/U:Amber)

Exploitation Status

Palo Alto Networks is not aware of any malicious exploitation of this issue.

Weakness Type and Impact

CWE-266: Incorrect Privilege Assignment

CAPEC-233 Privilege Escalation

Solution

This issue is fixed in MetaDefender Endpoint Security SDK 4.3.4451 on Windows, and all later MetaDefender Endpoint Security SDK versions on Windows. To mitigate this issue in the GlobalProtect App on Windows update to one of the listed versions (these versions include the updated MetaDefender Endpoint Security SDK):

Workarounds and Mitigations

No known workarounds or mitigations exist for this issue.

Acknowledgments

Timeline