The vulnerability CVE-2025-34109 involves an uncontrolled search path element (CWE-427) in Panda Security's 2016 product line. Specifically, PSEvents.exe runs hourly with SYSTEM privileges and loads DLL files from a directory writable by non-privileged users without validating the DLL source. This insecure DLL loading can be exploited by an attacker with write access to the directory to execute arbitrary code with elevated SYSTEM privileges. Affected products include Panda Global Protection 2016, Panda Antivirus Pro 2016, Panda Small Business Protection, and Panda Internet Security 2016, all versions up to 16.1.2. The CVSS 4.0 base score is 8.5, indicating high severity.

Successful exploitation allows an attacker with low privileges to achieve arbitrary code execution with SYSTEM-level privileges on affected systems. This can lead to full system compromise, unauthorized control, and potential persistence. There are no known exploits in the wild at this time.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict write permissions to the directory from which PSEvents.exe loads DLLs to prevent untrusted DLL injection. Monitor for unusual DLL files in the relevant directories and consider disabling or limiting the execution of PSEvents.exe if feasible.