The vulnerability identified as CVE-2025-59866 affects the installers of HCLSoftware's DFMPro for CATIA (version 4.1) and related products DFXAnalytics and DFXServer. It is classified under CWE-732, indicating incorrect permission assignment for a critical resource. The issue arises from insecure file permissions that permit any logged-in user without administrative privileges to overwrite or replace the executable file with a malicious binary, potentially enabling privilege escalation. The CVSS 3.1 base score is 3.3, reflecting low severity, with attack vector local, high attack complexity, low privileges required, and user interaction needed. There is no vendor advisory or patch information available at this time.

If exploited, this vulnerability allows a non-administrative user with local access to overwrite or replace critical executable files, potentially leading to privilege escalation. The confidentiality and integrity impacts are low, and availability is not affected. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local user access to systems running affected versions and monitor for unauthorized file modifications. Avoid running installers or software components with elevated privileges unless necessary.