CVE-2024-13944

Description

Link Following Local Privilege Escalation Vulnerability in NortonUtilitiesSvc in Norton Utilities Ultimate Version 24.2.16862.6344 on Windows 10 Pro x64 allows local attackers to escalate privileges and execute arbitrary code in the context of SYSTEM via the creation of a symbolic link and leveraging a TOCTTOU (time-of-check to time-of-use) attack.

PUBLISHED Reserved 2025-05-06 | Published 2025-05-09 | Updated 2025-10-13 | Assigner NLOK

Problem types

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

CWE-59 Improper Link Resolution Before File Access ('Link Following')

Product status

Credits

Vladislav Berghici of Trend Micro Research finder

Zero Day Initiative reporter

References

www.gendigital.com/us/en/contact-us/security-advisories/

cve.org (CVE-2024-13944)

nvd.nist.gov (CVE-2024-13944)

Download JSON