JVN#81917433
Optical Disc Archive Software (for Windows) registers a Windows service with an unquoted file path

Overview

Optical Disc Archive Software (for Windows) provided by Sony Corporation registers a Windows service with an unquoted file path.

Products Affected

• Optical Disc Archive Software (for Windows), versions 1.0.0 to 5.5.2

Description

Optical Disc Archive Software (for Windows) provided by Sony Corporation contains the following vulnerability.

• Unquoted search path or element (CWE-428)
  • CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.4
  • CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Base Score 6.7
  • CVE-2025-62225

Impact

A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.

Solution

Update the Software
Update the software to the latest version according to the information provided by the developer.