Bitdefender vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-6851 An Improper link resolution before file access ('link following') vulnerability in the File Shredder module as used in Bitdefender Total Security and Internet SHigh 7 · Jul 14, 2026
• CVE-2026-10047 The Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability in the real-mode hook handler, implemented in napoca/kernel/handler.cHigh 8.5 · Jun 2, 2026
• CVE-2026-10046 Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability in the BIOS INT 0x15 / E820 memory map handler, implemented in napoca/gueHigh 8.5 · Jun 2, 2026
• CVE-2025-7073 A local privilege escalation vulnerability in Bitdefender Total Security versions prior to 27.0.47.241 allows low-privileged attackers to elevate privileges.High 8.8 · Dec 10, 2025
• CVE-2025-2244 A vulnerability in the sendMailFromRemoteSource method in Emails.php  as used in Bitdefender GravityZone Console unsafely uses php unserialize() on user-supplieCritical 9.5 · Apr 4, 2025
• CVE-2024-13872 Bitdefender Box, versions 1.3.11.490 through 1.3.11.505, uses the insecure HTTP protocol to download assets over the Internet to update and restart daemons and Critical 9.4 · Mar 12, 2025
• CVE-2024-13871 A command injection vulnerability exists in the /check_image_and_trigger_recovery API endpoint of Bitdefender Box 1 (firmware version 1.3.11.490).Critical 9.4 · Mar 12, 2025
• CVE-2020-8094 An untrusted search path vulnerability in testinitsigs.exe as used in Bitdefender Antivirus Free 2020 allows a low-privilege attacker to execute code as SYSTEM High 8.8 · Jan 15, 2025
• CVE-2024-11128 A vulnerability in the BitdefenderVirusScanner binary as used in Bitdefender Virus Scanner for MacOS may allow .dynamic library injection (DYLD injection) withoHigh 8.4 · Jan 13, 2025
• CVE-2023-49570 A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software trusts a certificate issued by an entity that High 8.6 · Oct 18, 2024
• CVE-2023-6058 A vulnerability has been identified in Bitdefender Safepay's handling of HTTPS connections.High 8.6 · Oct 18, 2024
• CVE-2023-6057 A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in the improper trust of certificates issued using tHigh 8.6 · Oct 18, 2024
• CVE-2023-6056 A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in the improper trust of self-signed certificates.High 8.6 · Oct 18, 2024
• CVE-2023-6055 A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software fails to properly validate website certificateHigh 8.6 · Oct 18, 2024
• CVE-2023-49567 A vulnerability has been identified in the Bitdefender Total Security HTTPS scanning functionality where the product incorrectly checks the site's certificate, High 8.6 · Oct 18, 2024
• CVE-2024-6980 A verbose error handling issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery.Critical 9.2 · Jul 31, 2024
• CVE-2024-4177 A host whitelist parser issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery.High 8.1 · Jun 6, 2024
• CVE-2024-2224 Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in the UpdateServer component of Bitdefender GravityZone allows an High 8.1 · Apr 9, 2024
• CVE-2024-2223 An Incorrect Regular Expression vulnerability in Bitdefender GravityZone Update Server allows an attacker to cause a Server Side Request Forgery and reconfigureHigh 8.1 · Apr 9, 2024
• CVE-2023-6154 A configuration setting issue in seccenter.exe as used in Bitdefender Total Security, Bitdefender Internet Security, Bitdefender Antivirus Plus, Bitdefender AntHigh 7.8 · Apr 1, 2024
• CVE-2023-3633 An out-of-bounds write vulnerability in Bitdefender Engines on Windows causes the engine to crash.High 8.1 · Jul 14, 2023
• CVE-2022-3369 An Improper Access Control vulnerability in the bdservicehost.exe component, as used in Bitdefender Engines for Windows, allows an attacker to delete privilegedHigh 8.6 · Nov 1, 2022
• CVE-2022-2830 Deserialization of Untrusted Data vulnerability in the message processing component of Bitdefender GravityZone Console allows an attacker to pass unsafe commandHigh 8.8 · Sep 5, 2022
• CVE-2022-0677 Improper Handling of Length Parameter Inconsistency vulnerability in the Update Server component of Bitdefender Endpoint Security Tools (in relay role), GravityHigh 7.5 · Apr 7, 2022
• CVE-2021-4199 Incorrect Permission Assignment for Critical Resource vulnerability in the crash handling component BDReinit.exe as used in Bitdefender Total Security, InternetHigh 7.8 · Mar 7, 2022