CVE-2025-29745: Emsisoft Anti-Malware · Information Exposure
Source CVE Database V5
Not known to be exploited · CVSS 7.5 High · fixed in 2024.12 : patch Emsisoft Anti-Malware soon.
Data as of 26 Oct 2026, 17:16 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 36% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Affects
- Emsisoft Anti-Malware prior to 2024.12
- Patch
- Available – fixed in 2024.12
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 5 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
Organizations should prioritize updating Emsisoft Anti-Malware to version 2024.12 or later once available, as this is expected to contain the fix for the vulnerability. If you cannot patch yet, it is critical to implement strict controls on the handling and scanning of A2S extension files, including blocking or quarantining such files from untrusted sources. Network segmentation and strict egress filtering can reduce exposure to remote servers hosting malicious files. Monitoring network traffic for unusual authentication attempts or NTLM relay activities can help detect exploitation attempts. Employing multi-factor authentication (MFA) for network access reduces the risk posed by compromised hashes. Security teams should also conduct targeted threat hunting for signs of lateral movement or credential dumping activities. Additionally, educating users about the risks of opening unknown or unsolicited scan files and reinforcing secure file handling policies will reduce the likelihood of successful exploitation.
Description
A vulnerability affecting the scanning module in Emsisoft Anti-Malware prior to 2024.12 allows attackers on a remote server to obtain Net-NTLMv2 hash information via a specially created A2S (Emsisoft Custom Scan) extension file.