CVE-2025-0121

Summary

A null pointer dereference vulnerability in the Palo Alto Networks Cortex® XDR agent on Windows devices allows a low-privileged local Windows user to crash the agent. Additionally, malware can use this vulnerability to perform malicious activity without Cortex XDR being able to detect it.

Affected Software

VendorProductVersion RangeStatus
Palo Alto NetworksCortex XDR Agent8.7.0 < 6.3.3unaffected
Palo Alto NetworksCortex XDR Agent8.6.0 < 8.6.1affected
Palo Alto NetworksCortex XDR Agent8.5.0 < 8.5.2affected
Palo Alto NetworksCortex XDR Agent8.3-CE < 8.3.101-CE HFaffected
Palo Alto NetworksCortex XDR Agent7.9-CE < 7.9.103-CE HFaffected

Weaknesses

  • CWE-476: CWE-476 NULL Pointer Dereference

Workarounds

There are no known workarounds for this issue.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References