Panda Internet Security 2016 up to 16.1.2 DLL File Parser PSEvents.exe uncontrolled search path

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Panda Global Protection 2016, Antivirus Pro 2016, Small Business Protection and Internet Security 2016 up to 16.1.2. This affects an unknown function of the file PSEvents.exe of the component DLL File Parser. Performing a manipulation results in uncontrolled search path. This vulnerability is identified as CVE-2025-34109. The attack is only possible with local access. Additionally, an exploit exists.

Detailsinfo

A vulnerability was found in Panda Global Protection 2016, Antivirus Pro 2016, Small Business Protection and Internet Security 2016 up to 16.1.2. It has been classified as critical. This affects an unknown functionality of the file PSEvents.exe of the component DLL File Parser. The manipulation with an unknown input leads to a uncontrolled search path vulnerability. CWE is classifying the issue as CWE-427. The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

PSEvents.exe in multiple Panda Security products runs hourly with SYSTEM privileges and loads DLL files from a user-writable directory without proper validation. An attacker with low-privileged access who can write DLL files to the monitored directory can achieve arbitrary code execution with SYSTEM privileges. Affected products include Panda Global Protection 2016, Panda Antivirus Pro 2016, Panda Small Business Protection, and Panda Internet Security 2016 (all versions up to 16.1.2).

The advisory is shared at web.archive.org. This vulnerability is uniquely identified as CVE-2025-34109 since 04/15/2025. The exploitability is told to be difficult. An attack has to be approached locally. Technical details and a public exploit are known. MITRE ATT&CK project uses the attack technique T1574 for this issue.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Exploit-DB (40020). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Anti-Malware Software

Vendor

• Panda

Name

• Antivirus Pro 2016
• Global Protection 2016
• Internet Security 2016
• Small Business Protection

Version

• 16.1.0
• 16.1.1
• 16.1.2

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion