CVE-2024-1867 is a high severity (CVSS 7.8) local privilege escalation in G DATA Total Security, in the Backup Service. A low privileged user can abuse a symbolic link to delete a file. ZDI lists 25.5.17.355 as the fixed version, so update to that or later.
What's affected
G DATA Total Security, in installations before 25.5.17.355. The ZDI advisory says the issue is fixed in version 25.5.17.355. The NVD record lists the product without version bounds.
The flaw is in the G DATA Backup Service. According to the advisory, by creating a symbolic link, an attacker can abuse the service to delete a file, and use that to escalate privileges and execute code as SYSTEM. The weakness is CWE-59, improper link resolution before file access, also known as link following.
The attacker must first be able to run low privileged code on the target machine, so this is a second stage bug, not an entry point. The vector is local with low privileges and no user interaction.
ZDI reported the issue to the vendor on 9 January 2024 and released the advisory on 31 May 2024, with an update on 1 July 2024. The NVD record was published on 22 November 2024. The sibling issue CVE-2024-1868 abuses the same service to overwrite a file, with advisory ZDI-24-558.
How to check if you're exposed
Open G DATA Total Security and check the version under its settings or About page. Anything lower than 25.5.17.355 is in the described range.
On Windows you can also list it from PowerShell:
Get-Package | Where-Object { $_.Name -match "G DATA" } | Select-Object Name, Version
Make sure the program itself is updating. If automatic updates are off, or the subscription has lapsed, the product can stay on an old build without any visible warning.
What to do now
- Check the installed version of G DATA Total Security on each machine.
- Update to 25.5.17.355 or later through the product updater.
- Confirm that automatic program updates are enabled and the licence is current.
- Limit local administrative rights and untrusted code execution on shared machines, since the attacker needs a foothold first.
- On managed fleets, check the central console for machines that are behind on program versions.
Why it matters
Link following bugs are about a privileged process acting on a path without checking what the path points to. A service running as SYSTEM that deletes or overwrites a file in a location a normal user can write to can be tricked: the user swaps in a link to a different, protected file, and the service dutifully changes that instead. Deleting the right file can open the door to code execution as SYSTEM.
Security software is a notable place for these bugs. It runs with high privilege by design, so any weakness in its helper services has outsized impact. Updating it matters as much as updating the operating system.
The record's Known Exploited Vulnerabilities flag is false, and the advisory does not report exploitation.
Quick check
Can this be exploited remotely?
No. The vector is local. An attacker must already be able to run low privileged code on the machine.
Which version fixes it?
ZDI lists 25.5.17.355 as the fixed version.
Sources
Last reviewed: 19 October 2026.
