ZoneAlarm Anti-Ransomware before version 1.0.713 copies files for the report from a directory with low privileges. A sophisticated timed attacker can replace those files with malicious or linked content, such as exploiting CVE-2020-0896 on unpatched systems.

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-6012
• https://danishcyberdefence.dk/blog/zonealarm-check-point
• https://www.zonealarm.com/anti-ransomware/release-history
• https://www.zonealarm.com/software/extreme-security/release-history