CVE-2024-5929 is an uncontrolled search path flaw in the Patch Management Agent of VIPRE Advanced Security, scored 7.8 (High). The agent loads a file from an unsecured location, which lets a local attacker run code as SYSTEM. Install the vendor update and confirm the build.
What's affected
The record lists VIPRE Advanced Security 12.0.1.214. The Patch Management Agent loads a file from a location that a low-privileged user can influence, and the attacker executes code in the context of SYSTEM. The weakness is CWE-427, uncontrolled search path element. As with its siblings, the attacker needs low-privileged code execution first.
ZDI-24-818 is the advisory tied to this record, with the internal tag ZDI-CAN-22316. The fetched page for the sibling advisory ZDI-24-817 says the vendor released an update and refers to its Windows release notes without naming a version, and I treated this advisory the same way. I could not load the VIPRE release notes page named in the record.
NVD says 7.8 High. No vendor score was found. Not on the KEV list per the record.
How to check if you're exposed
Check the agent version, then compare with the vendor release notes. For the search path angle specifically, review the folders the agent loads files from and confirm normal users cannot write there. On Windows you can list permissions on a folder:
icacls "C:\path\to\agent\folder"
Replace the path with the folder shown in the agent configuration. Look for entries that grant write access to Users or Everyone.
What to do now
- Update VIPRE Advanced Security and make sure the Patch Management Agent updated with it.
- Ask the vendor for the exact build that closes CVE-2024-5929 and note it in your records.
- Check write permissions on the agent install and data folders and remove write access for standard users.
- Reduce interactive logons on machines running the agent.
- Run the same review for CVE-2024-5928 and CVE-2024-5930.
Why it matters
A search path bug arises when a program looks for a file in several places and one of them is writable by an ordinary user. The attacker places a file there, and the privileged program loads it as if it were its own.
Fixes usually pin the full path of the file or tighten folder permissions. For defenders the lesson is that folder permissions on security software are part of its attack surface, and are worth auditing on every machine image.
Quick check
How is this different from CVE-2024-5928?
CVE-2024-5928 abuses a symbolic link to delete a file. This one loads a file from an unsecured location. Both give SYSTEM and both need a local foothold.
Do I need to patch if only admins log in?
Lower risk, but updating is still the right move because phishing or malware can supply the foothold.
Sources
- ZDI-24-818
- VIPRE Windows release notes for 27 February 2024 (listed in the record, I could not load it)
- NVD record for CVE-2024-5929
Last reviewed: 19 October 2026.
