---
id: CVE-2025-0131
title: >-
  GlobalProtect App: Incorrect Privilege Management Vulnerability in OPSWAT
  MetaDefender Endpoint Security SDK
summary: >-
  An incorrect privilege management vulnerability in the OPSWAT MetaDefender
  Endpoint Security SDK used by the Palo Alto Networks GlobalProtect™ app on
  Windows devices allows a locally authenticated non-administrative Windows user
  to escal…
severity: high
cvss: 7.1
cvssVector: >-
  CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/AU:N/R:U/V:D/U:Amber
cvssSource: cna
cwe:
  - CWE-266
vendor: OPSWAT
product: MetaDefender Endpoint Security SDK
affected:
  - metadefender_endpoint_security_sdk >= 4.3.0 < 4.3.4451
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2025-05-17T03:56:04.216714Z'
published: '2025-05-14'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T00:12:00.655Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-0131'
references:
  - url: 'https://security.paloaltonetworks.com/CVE-2025-0131'
  - url: 'https://www.opswat.com/docs/mdsdk/release-notes/cve-2025-0131'
tags:
  - cve.org
epss: 0.00157
epssPercentile: 0.04859
ingestedAt: '2026-11-05T20:33:06.647Z'
---

## Overview

An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM. However, execution requires that the local user also successfully exploits a race condition, which makes this vulnerability difficult to exploit.

## Affected

- `metadefender_endpoint_security_sdk >= 4.3.0 < 4.3.4451`

## Remediation

This issue is fixed in MetaDefender Endpoint Security SDK 4.3.4451 on Windows, and all later MetaDefender Endpoint Security SDK versions on Windows. To mitigate this issue in the GlobalProtect App on Windows update to one of the listed versions (these versions include the updated MetaDefender Endpoint Security SDK):
Version
Suggested Solution
GlobalProtect App 6.3 on WindowsUpgrade to 6.3.3 or laterGlobalProtect App 6.2 on Windows
Upgrade to 6.2.8 or later
GlobalProtect App 6.1 on Windows
Upgrade to 6.2.8 or later or 6.3.3 or later
GlobalProtect App 6.0 on Windows
Upgrade to 6.2.8 or later or 6.3.3 or later
GlobalProtect App on macOSNot applicableGlobalProtect App on LinuxNot applicableGlobalProtect App on iOSNot applicableGlobalProtect App on AndroidNot applicableGlobalProtect UWP AppNot applicable

### Workarounds

No known workarounds or mitigations exist for this issue.