EUVD-2025-208751

A local, non-privileged attacker can abuse a vulnerable IOCTL interface exposed by the OpenEDR 2.5.1.0 kernel driver to modify the DLL injection path used by the product. By redirecting this path to a user-writable location, an attacker can cause OpenEDR to load an attacker-controlled DLL into...

PT-2026-25767

Name of the Vulnerable Software and Affected Versions OpenEDR version 2.5.1.0 Description A local attacker can circumvent the self-defense mechanism in OpenEDR by renaming a malicious executable to match a trusted process name, such as csrss.exe, edrsvc.exe, or edrcon.exe. This allows unauthorize...

CVE-2025-69783

A local attacker can bypass OpenEDR's 2.5.1.0 self-defense mechanism by renaming a malicious executable to match a trusted process name e.g., csrss.exe, edrsvc.exe, edrcon.exe. This allows unauthorized interaction with the OpenEDR kernel driver, granting access to privileged functionality such as...

CVE-2025-69784

A local, non-privileged attacker can exploit a vulnerable IOCTL interface in the OpenEDR 2.5.1.0 kernel driver to modify the product's DLL injection path . By redirecting this path to a user-writable location, an attacker can force OpenEDR to load an attacker-controlled DLL into high-privilege pr...