CVE-2025-0288
Paragon-Software Paragon Backup \& Recovery 15 – 17.39
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2025-0288 is a high-severity an unspecified weakness vulnerability in Paragon-Software Paragon Backup \& Recovery. Its CVSS base score is 7.8 (High).
Operationally, ranked at the 40th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-0288 is an arbitrary kernel memory write vulnerability in the biontdrv.sys driver, affecting various Paragon Software products, particularly those in the Hard Disk Manager product line. The flaw arises from the memmove function failing to validate or sanitize user-controlled input, enabling attackers to overwrite kernel memory. Published on March 3, 2025, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact on confidentiality, integrity, and availability.
A local attacker with low privileges can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation allows arbitrary kernel memory writes, facilitating privilege escalation to kernel-level access and potential full system compromise.
Paragon Software has released a security patch specifically addressing the biontdrv.sys driver in all Hard Disk Manager product line products, as detailed in their support article. The CERT/CC vulnerability note (VU#726882) provides additional guidance, and users should check Paragon's support page for available patches to mitigate the issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5568
Vulnerability Data
Various Paragon Software products contain an arbitrary kernel memory vulnerability within biontdrv.sys, facilitated by the memmove function, which does not validate or sanitize user controlled input, allowing an attacker the ability to write arbitrary kernel memory and perform privilege escalation.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.