Threat Intelligence / CVE / CVE-2025-26125

CVE-2025-26125

CVSS v3.1 7.3 (HIGH) · EPSS 0.4% (higher than 37.3% of all scored CVEs) · Priority 7.1/10 · Published 2025-03-17

As of 2025-03-24, CVE-2025-26125 is a HIGH-severity vulnerability, CVSS v3.1 7.3, EPSS 0.4% (37.3th percentile). Threadlinqs Intelligence links 3 tracked threat campaigns to CVE-2025-26125, most recently “The Gentlemen RaaS overtakes Qilin as #1 ransomware operation, wields GentleKiller EDR-killer framework (400+ processes, 8 BYOVD variants) and 90% affiliate payouts”.

Last updated: 2025-03-24

What is CVE-2025-26125?

An exposed ioctl in the IMFForceDelete driver of IObit Malware Fighter v12.1.0 allows attackers to arbitrarily delete files and escalate privileges.

The record classifies CVE-2025-26125 under weakness class CWE-782. Its CVSS v3 base vector states that the flaw requires local access to the host, needs low-privilege credentials, needs a user to take an action first, and has high impact on confidentiality, integrity, availability. The identifier was first published 545 days ago.

Severity and exploitation probability

CVSS v3.1 base score: 7.3 — HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
EPSS (FIRST): 0.4% probability of exploitation in the next 30 days, higher than 37.3% of all scored CVEs
CISA KEV: Not listed in the CISA Known Exploited Vulnerabilities catalog
Threadlinqs priority: 7.1/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
Published: 2025-03-17, last modified 2025-03-24

Is CVE-2025-26125 being exploited?

Weaponised exploit code for CVE-2025-26125 is publicly available. 2 public proof-of-concept repositories are tracked for this identifier.

ZeroMemoryEx/CVE-2025-26125 (github)
trickest/cve (trickest)

Affected products and versions

No affected-product or package list has been recorded for CVE-2025-26125 in the tracked sources. The vendor advisory and the references below are the authoritative statement of what is affected.

How to fix CVE-2025-26125

No vendor patch reference has been recorded for CVE-2025-26125 in the tracked sources. Follow the references below for a fix, and treat any affected deployment as exposed until the vendor states otherwise.

Threat activity tracking CVE-2025-26125

3 tracked threats in the Threadlinqs corpus reference CVE-2025-26125, either in the campaign’s CVE list or as an indicator on the campaign record.

The Gentlemen RaaS overtakes Qilin as #1 ransomware operation, wields GentleKiller EDR-killer framework (400+ processes, 8 BYOVD variants) and 90% affiliate payouts — HIGH · 2026-07-14
The Gentlemen Ransomware: Worm-Like Self-Propagation and Network-Wide Encryption via Storm-2697's RaaS Affiliate Program — CRITICAL · 2026-07-06
GentleKiller BYOVD EDR-Killing Framework Operated by The Gentlemen RaaS (hastalamuerte / Qilin lineage) — HIGH · 2026-06-21

Sources

Enriched from CVE.org, FIRST EPSS, GitHub Security Advisories, public proof-of-concept repositories. Last verified by Threadlinqs on 2026-06-22.

Other references

Full detection coverage & IOCs for threats exploiting CVE-2025-26125 are available via the Threadlinqs MCP server (Purple tier). View plans →

← all vulnerabilities · Markdown version · Threadlinqs Intelligence