Bitdefender Total Security/Internet Security 25.0.7.29/26.0.10.45/27.0.25.114/27.0.46.231 File Shredder race condition

Summaryinfo

A vulnerability classified as problematic has been found in Bitdefender Total Security and Internet Security. This affects an unknown function of the component File Shredder Module. This manipulation causes race condition. This vulnerability is registered as CVE-2026-6851. The attack needs to be launched locally. No exploit is available.

Detailsinfo

A vulnerability has been found in Bitdefender Total Security and Internet Security and classified as problematic. Affected by this vulnerability is some unknown processing of the component File Shredder Module. The manipulation with an unknown input leads to a race condition vulnerability. The CWE definition for the vulnerability is CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An Improper link resolution before file access ('link following') vulnerability in the File Shredder module as used in Bitdefender Total Security and Internet Security on Windows allows a less-privileged local user to elevate rights by leveraging a race conditions via Symbolic Links. This issue affects Total Security: before 27.0.58.315; Internet Security: before 27.0.58.315.

The advisory is shared at bitdefender.com. This vulnerability is known as CVE-2026-6851 since 04/22/2026. The exploitation appears to be easy. An attack has to be approached locally. Neither technical details nor an exploit are publicly available.

Upgrading to version 27.0.58.315 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Bitdefender

Name

• Internet Security
• Total Security

Version

• 25.0.7.29
• 26.0.10.45
• 27.0.25.114
• 27.0.46.231

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion