ZDI 2026-03-03

ZDI-26-141: Trend Micro Apex One Security Agent iCore Service Signature Verification Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability

CVE-2025-71215

Machine-generated analysis · WAYSCloud LLM

The vulnerability involves a time-of-check time-of-use (TOCTOU) issue in the iCore Service's signature verification process, potentially allowing local privilege escalation.

Context

The affected component is the Trend Micro Apex One Security Agent's iCore Service. The vulnerability is a local privilege escalation due to improper handling of signature verification, specifically a TOCTOU condition. The advisory notes that an attacker must already have the ability to execute low-privileged code on the system. The CVSS score of 7.8 reflects the local attack vector and potential impact on system integrity.

Operator considerations

Check: Verify if Trend Micro Apex One Security Agent is installed and running on systems within the environment.

From Zero Day Initiative ↗

This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-71215.

Read the full advisory on ZDI →