CVE-2025-20094 Privilege escalation in Defense Platform Home Edition
An attacker can execute arbitrary code with SYSTEM privileges by exploiting an unprotected Windows messaging channel in Defense Platform Home Edition.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-20094?
CVE-2025-20094 is a high-severity vulnerability in Humming Heads Inc. Defense Platform Home Edition, published on 6 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Unprotected Windows messaging channel ('Shatter') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker sends a specially crafted message to the specific process of the Windows system where the product is running, arbitrary code may be executed with SYSTEM privilege.
Weakness: CWE-422
Which versions are affected by CVE-2025-20094?
It affects 1 product.
Products include Hummingheads Defense Platform.
How do I fix CVE-2025-20094?
No fix has been published for CVE-2025-20094 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-20094 being exploited?
There is no known exploitation of CVE-2025-20094 in the wild and no public exploit code.
Other vulnerabilities in Humming Heads Inc. Defense Platform Home Edition
- CVE-2025-23236 Memory corruption in Defense Platform Home Edition
- CVE-2025-22890 Privilege escalation in Defense Platform Home Edition
- CVE-2025-22894 Privilege escalation in Defense Platform Home Edition
- CVE-2025-24483 Null dereference in Defense Platform Home Edition
- CVE-2025-24845 Command injection in Defense Platform Home Edition
Sources
Also known as GHSA-x377-mmcg-mgm3.