CVE-2025-4455 is a critical vulnerability identified in Patch My PC Home Updater versions up to 5.1.3.0. The vulnerability arises from an uncontrolled search path issue involving multiple Windows system libraries such as advapi32.dll, kernel32.dll, shell32.dll, and others. This flaw allows an attacker with local access and low privileges to manipulate the search path used by the application or its components, potentially causing the application to load malicious DLLs or code instead of legitimate system libraries. The vulnerability does not require user interaction but has a high attack complexity, making exploitation difficult. The vulnerability affects the integrity and availability of the system by enabling unauthorized code execution or system manipulation. The vendor has not responded to early disclosure attempts, and while no known exploits are currently in the wild, public disclosure means that exploitation attempts could emerge. The CVSS 4.0 score is 7.3 (high severity), reflecting local attack vector, high complexity, no user interaction, and significant impact on confidentiality, integrity, and availability. The vulnerability is rooted in the way Patch My PC Home Updater handles DLL search paths, which can be exploited to escalate privileges or execute arbitrary code locally.

For European organizations, this vulnerability poses a significant risk particularly to environments where Patch My PC Home Updater is used for patch management on Windows endpoints. Successful exploitation could lead to local privilege escalation, unauthorized code execution, or system compromise, undermining endpoint security and potentially allowing lateral movement within corporate networks. This could result in data breaches, disruption of business operations, or deployment of ransomware or other malware. Given the critical nature of patch management tools, compromise of such software could severely impact the integrity and availability of IT infrastructure. Organizations in sectors with strict regulatory requirements for data protection (e.g., finance, healthcare, critical infrastructure) could face compliance violations and reputational damage if exploited. The high complexity and local attack vector somewhat limit remote exploitation risk, but insider threats or compromised endpoints could still leverage this vulnerability.

European organizations should immediately identify and inventory all instances of Patch My PC Home Updater, specifically versions 5.1.0 through 5.1.3.0. Until a vendor patch is available, organizations should restrict local user privileges to the minimum necessary to prevent unauthorized local code execution. Employ application whitelisting and endpoint detection and response (EDR) solutions to monitor for suspicious DLL loading or process behaviors related to Patch My PC Home Updater. Consider isolating or disabling the use of this updater on critical systems where possible. Network segmentation can limit lateral movement if a local compromise occurs. Regularly review and harden DLL search order and environment variables to prevent DLL hijacking. Monitor security advisories for vendor patches or updates and apply them promptly once available. Additionally, conduct user training to reduce insider threat risks and implement strict access controls on endpoints to mitigate local exploitation opportunities.