CVE-2025-53395 Details
Description
Paramount Macrium Reflect through 2025-06-26 allows local attackers to execute arbitrary code with administrator privileges via a crafted .mrimgx backup file and a malicious VSSSvr.dll located in the same directory. When a user with administrative privileges mounts a backup by opening the .mrimgx file, Reflect loads the attacker's VSSSvr.dll after the mount completes. This occurs because of untrusted DLL search path behavior in ReflectMonitor.exe.
A vulnerability in Paramount Macrium Reflect, affecting versions through 2025-06-26, allows local attackers to execute arbitrary code with administrator privileges. This is achieved by placing a malicious VSSSvr.dll file in the same directory as a crafted .mrimgx backup file. When a user with administrative rights mounts the backup, Macrium Reflect loads the malicious DLL due to untrusted DLL search path behavior in ReflectMonitor.exe.
Users are advised to update to Macrium Reflect versions 8.1.8595, 8.1.8620, or 10.0.8576, all of which include the necessary security patch. For those using Macrium Site Manager, version 8.1.8602 is available for the same patch.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 4, 2025CISA-ADP
Assessed Aug 5, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://macrium.com | [email protected] | Vendor |
| https://www.macrium.com/blog/macrium-security-advisory-cve-2025-53394-cve-2025-53395 | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-427 | Uncontrolled Search Path Element | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Paramount Macrium Reflect | <= 8.1 <= 2024 |
CPE
Remediation
| |
| Paramount Macrium Reflect X | All versions |
CPE
Remediation
| |
| Paramount Macrium Reflect LTSC 2024 | All versions |
CPE
Remediation
| |
| Paramount Macrium Reflect 8.1 | All versions |
CPE
Remediation
| |
| Paramount Site Manager | All versions |
CPE
Remediation
| |
| Paramount SiteManager Platform | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2025 | CVE Modified | CISA-ADP |
| Aug 4, 2025 | New CVE Received | [email protected] |