CVEvulnerability
CVE-2025-0288
7.8 HIGH
Official page ↗
- Status
- Analyzed
- Published
- 2025-03-03
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
Various Paragon Software products contain an arbitrary kernel memory vulnerability within biontdrv.sys, facilitated by the memmove function, which does not validate or sanitize user controlled input, allowing an attacker the ability to write arbitrary kernel memory and perform privilege escalation.
Affected configurations
• paragon-software paragon backup \& recovery (>= 15 <= 17.39)
• paragon-software paragon disk wiper (>= 15 <= 16)
• paragon-software paragon drive copy (>= 15 <= 16)
• paragon-software paragon hard disk manager (>= 15 <= 17.39)
• paragon-software paragon migrate os to ssd (>= 4 <= 5)
• paragon-software paragon partition manager (>= 15 <= 17.39)
References
- https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys Vendor Advisory
- https://www.kb.cert.org/vuls/id/726882 Third Party Advisory
- https://www.paragon-software.com/support/#patches Product