CVE-2025-0287

Published: Mar 3, 2025Modified: Jun 17, 2026

5.1

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability: 2.5 / Impact: 2.5

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Various Paragon Software products contain a null pointer dereference vulnerability within biontdrv.sys that is caused by a lack of a valid MasterLrp structure in the input buffer, allowing an attacker to execute arbitrary code in the kernel, facilitating privilege escalation.

Affected (6)

Products: Paragon Software: Paragon Backup & Recovery, Paragon Disk Wiper, Paragon Drive Copy, Paragon Hard Disk Manager, Paragon Migrate Os To Ssd, Paragon Partition Manager

Paragon Software

6 products

Paragon Backup & Recovery

Paragon Disk Wiper

Paragon Drive Copy

Paragon Hard Disk Manager

Paragon Migrate Os To Ssd

Paragon Partition Manager

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Paragon Software Paragon Backup & Recovery	From 15 to 17.39
Paragon Software Paragon Disk Wiper	From 15 to 16
Paragon Software Paragon Drive Copy	From 15 to 16
Paragon Software Paragon Hard Disk Manager	From 15 to 17.39
Paragon Software Paragon Migrate Os To Ssd	From 4 to 5
Paragon Software Paragon Partition Manager	From 15 to 17.39

Related CWEs

CWE-476

NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

References (3)

https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys

Source: cret@cert.org

Vendor Advisory

https://www.kb.cert.org/vuls/id/726882

Source: cret@cert.org

Third Party Advisory

https://www.paragon-software.com/support/#patches

Source: cret@cert.org

Product

Timeline

No history available yet.