High severity · published Sep 30, 2025
CVE-2025-11178
Local privilege escalation due to DLL hijacking vulnerability
7.3
CVSS
0.2%
EPSS
No
On KEV
Description
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis True Image (Windows) before build 42386, Acronis True Image for Western Digital (Windows) before build 42636, Acronis True Image for SanDisk (Windows) before build 42679, Acronis True Image OEM (Windows) before build 42575.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AT
Acronis True Image · Acronis
before 42386 · source: vendor
AT
Acronis True Image OEM · Acronis
before 42575 · source: vendor
AT
Acronis True Image for SanDisk · Acronis
before 42679 · source: vendor
AT
Acronis True Image for Western Digital · Acronis
before 42636 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-11178
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-11178
security-advisory.acronis.com
https://security-advisory.acronis.com/advisories/SEC-7078
More from Acronis True Image
8.8
CVE-2025-7779
Local privilege escalation due to insecure XPC service configuration
7.8
CVE-2026-33092
Local privilege escalation due to improper handling of environment variables
7.8
CVE-2026-28727
Local privilege escalation due to insecure Unix socket permissions
6.7
CVE-2026-33271
Local privilege escalation due to insecure folder permissions
6.7
CVE-2026-27774
Local privilege escalation due to DLL hijacking vulnerability