{"id":"CVE-2025-26624","summary":"Local Privilege Escalation in Rufus 4.6 and previous versions","details":"Rufus is a utility that helps format and create bootable USB flash drives. A DLL hijacking vulnerability in Rufus 4.6.2208 and earlier versions allows an attacker loading and executing a malicious DLL with escalated privileges (since the executable has been granted higher privileges during the time of launch) due to the ability to inject a malicious `cfgmgr32.dll` in the same directory as the executable and have it side load automatically. This is fixed in commit `74dfa49`, which will be part of version 4.7. Users are advised to upgrade as soon as version 4.7 becomes available. There are no known workarounds for this vulnerability.","aliases":["GHSA-p8p5-r296-g2jv"],"modified":"2026-08-12T03:51:37.201972354Z","published":"2025-02-18T22:40:59.053Z","database_specific":{"cwe_ids":["CWE-426","CWE-427"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/26xxx/CVE-2025-26624.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/26xxx/CVE-2025-26624.json"},{"type":"ADVISORY","url":"https://github.com/pbatard/rufus/security/advisories/GHSA-p8p5-r296-g2jv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-26624"},{"type":"FIX","url":"https://github.com/pbatard/rufus/commit/74dfa49707fd626b58d776d3400295740a29e23e"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/pbatard/rufus","events":[{"introduced":"0"},{"fixed":"74dfa49707fd626b58d776d3400295740a29e23e"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"4.7"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-26624.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}