The vulnerability CVE-2025-34109 involves an uncontrolled search path element (CWE-427) in Panda Security's 2016 product line. The PSEvents.exe process, running hourly with SYSTEM privileges, loads DLLs from a user-writable directory without validating the source or integrity of those DLLs. This insecure DLL loading can be exploited by an attacker with low privileges who can write malicious DLL files to the monitored directory, resulting in arbitrary code execution with elevated SYSTEM privileges. Affected products include Panda Global Protection 2016, Panda Antivirus Pro 2016, Panda Small Business Protection, and Panda Internet Security 2016, all versions up to 16.1.2. The CVSS 4.0 base score is 8.5, reflecting high severity with local attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows a low-privileged attacker to execute arbitrary code with SYSTEM-level privileges on affected Panda Security 2016 products. This can lead to full system compromise, including unauthorized access, modification, or disruption of system operations. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Panda Security advisories for updates. Until a fix is available, restricting write permissions to the directory monitored by PSEvents.exe or running the process with reduced privileges may mitigate risk, but these actions should be validated against operational requirements.