CVE-2025-0288

Published: Mar 3, 2025Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Various Paragon Software products contain an arbitrary kernel memory vulnerability within biontdrv.sys, facilitated by the memmove function, which does not validate or sanitize user controlled input, allowing an attacker the ability to write arbitrary kernel memory and perform privilege escalation.

Affected (6)

Products: Paragon Software: Paragon Backup & Recovery, Paragon Disk Wiper, Paragon Drive Copy, Paragon Hard Disk Manager, Paragon Migrate Os To Ssd, Paragon Partition Manager

Paragon Software

6 products

Paragon Backup & Recovery

Paragon Disk Wiper

Paragon Drive Copy

Paragon Hard Disk Manager

Paragon Migrate Os To Ssd

Paragon Partition Manager

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Paragon Software Paragon Backup & Recovery	From 15 to 17.39
Paragon Software Paragon Disk Wiper	From 15 to 16
Paragon Software Paragon Drive Copy	From 15 to 16
Paragon Software Paragon Hard Disk Manager	From 15 to 17.39
Paragon Software Paragon Migrate Os To Ssd	From 4 to 5
Paragon Software Paragon Partition Manager	From 15 to 17.39

References (3)

https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys

Source: cret@cert.org

Vendor Advisory

https://www.kb.cert.org/vuls/id/726882

Source: cret@cert.org

Third Party Advisory

https://www.paragon-software.com/support/#patches

Source: cret@cert.org

Product

Timeline

No history available yet.