CVE-2025-0286

Published: Mar 3, 2025Modified: Jun 17, 2026

8.4

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.5 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Various Paragon Software products contain an arbitrary kernel memory write vulnerability within biontdrv.sys that is caused by a failure to properly validate the length of user supplied data, which can allow an attacker to execute arbitrary code on the victim machine.

Affected (6)

Products: Paragon Software: Paragon Backup & Recovery, Paragon Disk Wiper, Paragon Drive Copy, Paragon Hard Disk Manager, Paragon Migrate Os To Ssd, Paragon Partition Manager

Paragon Software

6 products

Paragon Backup & Recovery

Paragon Disk Wiper

Paragon Drive Copy

Paragon Hard Disk Manager

Paragon Migrate Os To Ssd

Paragon Partition Manager

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Paragon Software Paragon Backup & Recovery	From 15 to 17.39
Paragon Software Paragon Disk Wiper	From 15 to 16
Paragon Software Paragon Drive Copy	From 15 to 16
Paragon Software Paragon Hard Disk Manager	From 15 to 17.39
Paragon Software Paragon Migrate Os To Ssd	From 4 to 5
Paragon Software Paragon Partition Manager	From 15 to 17.39

Related CWEs

CWE-1284

Improper Validation of Specified Quantity in Input

The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

References (3)

https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys

Source: cret@cert.org

Vendor Advisory

https://www.kb.cert.org/vuls/id/726882

Source: cret@cert.org

Third Party Advisory

https://www.paragon-software.com/support/#patches

Source: cret@cert.org

Product

Timeline

No history available yet.